From 872fa44741fe9974303bf564f01a295599b91a35 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 24 May 2022 13:04:12 -0700 Subject: [PATCH 001/148] initialdraft --- ...sonation_weak_encryption_configuration.yml | 51 +++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml new file mode 100644 index 0000000000..d4065a6a07 --- /dev/null +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -0,0 +1,51 @@ +name: Splunk protocol impersonation weak encryption configuration +id: 839d12a6-b119-4d44-ac4f-13eed95412c8 +version: 1 +date: '2022-05-24' +author: Rod Soto, Splunk +type: TTP +datamodel: [] +search: 'index=_internal sourcetype=splunkd event_message="*SSL*" AND event_message="*ERROR*" OR event_message="*unknown CA*" |stats count by host source component event_message | dedup component host' +description: On . +how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This search will provide search UI requests with path traversal parameter ("../../../../../../../../../") which shows exploitation attempts. +known_false_positives: This search may find additional path traversal exploitation attempts. +references: +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0506.html +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2022-0000 + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + dataset: + - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/path_traversal_spl_injection.txt + impact: 50 + kill_chain_phases: + - Exploitation + message: Path traversal exploitation attempt from $clientip$ + mitre_attack_id: + - T1083 + observable: + - name: clientip + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - status + - clientip + - method + - uri_path + - uri_query + risk_score: 40 + security_domain: threat From 352ac64d51b8cf8b1bf2b025666e6db007e38084 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 24 May 2022 13:12:46 -0700 Subject: [PATCH 002/148] initialdrafta --- ...ol_impersonation_weak_encryption_configuration.yml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index d4065a6a07..c657d3c10d 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -3,14 +3,15 @@ id: 839d12a6-b119-4d44-ac4f-13eed95412c8 version: 1 date: '2022-05-24' author: Rod Soto, Splunk -type: TTP +type: Hunting datamodel: [] search: 'index=_internal sourcetype=splunkd event_message="*SSL*" AND event_message="*ERROR*" OR event_message="*unknown CA*" |stats count by host source component event_message | dedup component host' -description: On . -how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This search will provide search UI requests with path traversal parameter ("../../../../../../../../../") which shows exploitation attempts. -known_false_positives: This search may find additional path traversal exploitation attempts. +description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store. +how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. +known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. references: -- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0506.html +- https://www.splunk.com/en_us/product-security. +- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation tags: analytic_story: - Splunk Vulnerabilities From 9d1e62c7d05077dce1635b8f512798bbb464c3bf Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 24 May 2022 13:55:47 -0700 Subject: [PATCH 003/148] initialdraftb --- ...sonation_weak_encryption_configuration.yml | 24 +++++++------------ 1 file changed, 9 insertions(+), 15 deletions(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index c657d3c10d..c593f9f514 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -8,7 +8,7 @@ datamodel: [] search: 'index=_internal sourcetype=splunkd event_message="*SSL*" AND event_message="*ERROR*" OR event_message="*unknown CA*" |stats count by host source component event_message | dedup component host' description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. -known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. +known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. references: - https://www.splunk.com/en_us/product-security. - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation @@ -18,35 +18,29 @@ tags: asset_type: Endpoint cve: - CVE-2022-0000 - cis20: - - CIS 3 - - CIS 5 - - CIS 16 confidence: 80 context: - Source:Endpoint dataset: - - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/path_traversal_spl_injection.txt + - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/splk_protocol_impersonation_weak_encryption_configuration.txt impact: 50 kill_chain_phases: - Exploitation - message: Path traversal exploitation attempt from $clientip$ + message: Failed to validate certificate on host$ mitre_attack_id: - T1083 observable: - - name: clientip - type: IP Address + - name: host + type: host role: - - Attacker + - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud required_fields: - - status - - clientip - - method - - uri_path - - uri_query + - host + - event_message + - component risk_score: 40 security_domain: threat From a802fecce8e0540e1239832bcb02f919a8d91cb3 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 24 May 2022 14:01:02 -0700 Subject: [PATCH 004/148] initialdraftc --- ...unk_protocol_impersonation_weak_encryption_configuration.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index c593f9f514..be511b8fe2 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -28,7 +28,7 @@ tags: - Exploitation message: Failed to validate certificate on host$ mitre_attack_id: - - T1083 + - T1588.004 observable: - name: host type: host From 99d314eeeae5398ec7bb068a1bf371cab80b4611 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 24 May 2022 17:29:15 -0700 Subject: [PATCH 005/148] initialsearchskeleton --- ...l_impersonation_weak_encryption_configuration.yml | 8 ++++---- macros/splk_cert_validation_tls.yml | 4 ++++ ...ersonation_weak_encryption_configuration.test.yml | 12 ++++++++++++ 3 files changed, 20 insertions(+), 4 deletions(-) create mode 100644 macros/splk_cert_validation_tls.yml create mode 100644 tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index be511b8fe2..0f1bbb86ef 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -5,12 +5,12 @@ date: '2022-05-24' author: Rod Soto, Splunk type: Hunting datamodel: [] -search: 'index=_internal sourcetype=splunkd event_message="*SSL*" AND event_message="*ERROR*" OR event_message="*unknown CA*" |stats count by host source component event_message | dedup component host' +search: '|splk_cert_validation_tls event_message="*SSL*" AND event_message="*ERROR*" component=HttpListener | stats count by host component event_message |dedup host | splunk_protocol_impersonation_weak_encryption_configuration_filter' description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. references: -- https://www.splunk.com/en_us/product-security. +- https://www.splunk.com/en_us/product-security - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation tags: analytic_story: @@ -22,13 +22,13 @@ tags: context: - Source:Endpoint dataset: - - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1083/splunk/splk_protocol_impersonation_weak_encryption_configuration.txt + - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1588.004/splunk/splk_protocol_impersonation_weak_encryption_configuration.txt impact: 50 kill_chain_phases: - Exploitation message: Failed to validate certificate on host$ mitre_attack_id: - - T1588.004 + - T1588.004 observable: - name: host type: host diff --git a/macros/splk_cert_validation_tls.yml b/macros/splk_cert_validation_tls.yml new file mode 100644 index 0000000000..7162e5e54f --- /dev/null +++ b/macros/splk_cert_validation_tls.yml @@ -0,0 +1,4 @@ +definition: index=_internal sourcetype=splunkd +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: splunkd diff --git a/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml b/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml new file mode 100644 index 0000000000..de04dc05c5 --- /dev/null +++ b/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml @@ -0,0 +1,12 @@ +name: Splunk protocol impersonation weak encryption configuration Unit Test +tests: +- name: Splunk protocol impersonation weak encryption configuration + file: application/splunk_protocol_impersonation_weak_encryption_configuration.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: splk_protocol_impersonation_weak_encryption_configuration.txt + data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1588.004/splunk/splk_protocol_impersonation_weak_encryption_configuration.txt + source: "/opt/splunk/var/log/splunk/splunkd.log" + sourcetype: splunkd From 5680afbce7ee0b33086a9bb78b247660b92b463f Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 24 May 2022 17:35:46 -0700 Subject: [PATCH 006/148] fixtype --- ...unk_protocol_impersonation_weak_encryption_configuration.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index 0f1bbb86ef..77a9a1e58a 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -31,7 +31,7 @@ tags: - T1588.004 observable: - name: host - type: host + type: hostname role: - Victim product: From 16641935e0bab34c72a6d0ac6dc6a20ede4fc994 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 24 May 2022 17:37:39 -0700 Subject: [PATCH 007/148] fixanotherytpo --- ...k_protocol_impersonation_weak_encryption_configuration.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index 77a9a1e58a..1c7765c87c 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -30,8 +30,8 @@ tags: mitre_attack_id: - T1588.004 observable: - - name: host - type: hostname + - name: hostname + type: hostname role: - Victim product: From 6ee71634218e027902a8a853293ed6da42c588eb Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 24 May 2022 17:40:12 -0700 Subject: [PATCH 008/148] Hostname --- ...k_protocol_impersonation_weak_encryption_configuration.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index 1c7765c87c..e822c6a1ad 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -30,8 +30,8 @@ tags: mitre_attack_id: - T1588.004 observable: - - name: hostname - type: hostname + - name: Hostname + type: Hostname role: - Victim product: From b51c08851337622a586344cd9aeb2734600f086c Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 25 May 2022 10:55:42 -0500 Subject: [PATCH 009/148] Fixing typo --- tests/application/splunk_user_enumeration_attempt.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/application/splunk_user_enumeration_attempt.test.yml b/tests/application/splunk_user_enumeration_attempt.test.yml index 40e966b1af..e2672a23c5 100644 --- a/tests/application/splunk_user_enumeration_attempt.test.yml +++ b/tests/application/splunk_user_enumeration_attempt.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: audittail.log + - file_name: audittrail.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/splunkd_auth/audittrail.log source: audittrail sourcetype: audittrail From ef545637557f8d0e387ba103952a9d2fdb35cfe0 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 25 May 2022 13:54:26 -0500 Subject: [PATCH 010/148] Adding detection --- ...sonation_weak_encryption_configuration.yml | 45 ++++++++++--------- 1 file changed, 23 insertions(+), 22 deletions(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index e822c6a1ad..e3f2dfbc9a 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -1,46 +1,47 @@ -name: Splunk protocol impersonation weak encryption configuration -id: 839d12a6-b119-4d44-ac4f-13eed95412c8 +name: Splunk Protocol Impersonation Weak Encryption Configuration +id: 900892bf-70a9-4787-8c99-546dd98ce461 version: 1 -date: '2022-05-24' -author: Rod Soto, Splunk +date: '2022-05-25' +author: Lou Stella, Splunk type: Hunting datamodel: [] -search: '|splk_cert_validation_tls event_message="*SSL*" AND event_message="*ERROR*" component=HttpListener | stats count by host component event_message |dedup host | splunk_protocol_impersonation_weak_encryption_configuration_filter' -description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store. -how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. -known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. +description: On June 10th, 2022, Splunk released a security advisory relating to TLS validation occuring within the httplib and urllib python libraries shipped with Splunk. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. In addition to these settings, the PYTHONHTTPSVERIFY setting in $SPLUNK_HOME/etc/splunk-launch.conf needs to be enabled as well. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. +search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="PythonSslClientConfig" | table splunk_server sslVerifyServerCert sslVerifyServerName] | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-web/settings | table splunk_server serverCert sslVersions] | rename sslVerifyServerCert as "Server.conf:PythonSSLClientConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:PythonSSLClientConfig:sslVerifyServerName", serverCert as "Web.conf:Settings:serverCert", sslVersions as "Web.conf:Settings:sslVersions" | `splunk_protocol_impersonation_weak_encryption_configuration_filter`' +how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers. +known_false_positives: While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration. references: -- https://www.splunk.com/en_us/product-security - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation tags: analytic_story: - Splunk Vulnerabilities asset_type: Endpoint - cve: - - CVE-2022-0000 - confidence: 80 + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 100 context: - Source:Endpoint dataset: - - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1588.004/splunk/splk_protocol_impersonation_weak_encryption_configuration.txt + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log impact: 50 kill_chain_phases: - Exploitation - message: Failed to validate certificate on host$ + message: $splunk_server$ may not be properly validating TLS Certificates mitre_attack_id: - - T1588.004 + - T1001.003 + nist: + - DE.CM observable: - - name: Hostname - type: Hostname + - name: splunk_server + type: hostname role: - - Victim + - victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud required_fields: - - host - - event_message - - component - risk_score: 40 + - none + risk_score: 50 security_domain: threat From 7bd84418068bfb3989af7bca4491af2c2400d959 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 25 May 2022 13:55:43 -0500 Subject: [PATCH 011/148] Adding test, random data since irrelevant to detection --- ...rsonation_weak_encryption_configuration.test.yml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml b/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml index de04dc05c5..30ec9e3e5f 100644 --- a/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml +++ b/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml @@ -1,12 +1,13 @@ -name: Splunk protocol impersonation weak encryption configuration Unit Test +name: Splunk Protocol Impersonation Weak Encryption Configuration Unit Test tests: -- name: Splunk protocol impersonation weak encryption configuration +- name: Splunk Protocol Impersonation Weak Encryption Configuration file: application/splunk_protocol_impersonation_weak_encryption_configuration.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now attack_data: - - file_name: splk_protocol_impersonation_weak_encryption_configuration.txt - data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1588.004/splunk/splk_protocol_impersonation_weak_encryption_configuration.txt - source: "/opt/splunk/var/log/splunk/splunkd.log" - sourcetype: splunkd + - file_name: audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log + source: audittrail + sourcetype: audittrail + update_timestamp: true From b9d79c5ab18dbae939cedddac3b2e926cb9cdbbd Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Thu, 26 May 2022 07:25:17 -0700 Subject: [PATCH 012/148] changednameofdetection --- ...sonation_weak_encryption_simplerequest.yml | 44 +++++++++++++++++++ macros/splk_cert_validation_tls.yml | 4 ++ ...ion_weak_encryption_simplerequest.test.yml | 12 +++++ 3 files changed, 60 insertions(+) create mode 100644 detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml create mode 100644 macros/splk_cert_validation_tls.yml create mode 100644 tests/application/splunk_protocol_impersonation_weak_encryption_simplerequest.test.yml diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml new file mode 100644 index 0000000000..969e007c41 --- /dev/null +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -0,0 +1,44 @@ +name: Splunk protocol impersonation weak encryption simplerequest +id: 839d12a6-b119-4d44-ac4f-13eed95412c8 +version: 1 +date: '2022-05-24' +author: Rod Soto, Splunk +type: Hunting +datamodel: [] +search: '|splk_cert_validation_tls "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | splunk_protocol_impersonation_weak_encryption_simplerequest_filter' +description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store.This search warns about failure to validate certification using python3 request. +how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. +known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. +references: +- https://www.splunk.com/en_us/product-security +- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + confidence: 80 + context: + - Source:Endpoint + dataset: + - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1588.004/splunk/splk_protocol_impersonation_weak_encryption_simplerequest.txt + impact: 50 + kill_chain_phases: + - Exploitation + message: Failed to validate certificate on host$ + mitre_attack_id: + - T1588.004 + observable: + - name: Hostname + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - host + - event_message + - path + risk_score: 40 + security_domain: threat diff --git a/macros/splk_cert_validation_tls.yml b/macros/splk_cert_validation_tls.yml new file mode 100644 index 0000000000..f3a35ff78c --- /dev/null +++ b/macros/splk_cert_validation_tls.yml @@ -0,0 +1,4 @@ +definition: index=_internal sourcetype=splunk_python source=/opt/splunk/var/log/splunk/python.log +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: splunk_protocol_impersonation_weak_encryption_simplerequest diff --git a/tests/application/splunk_protocol_impersonation_weak_encryption_simplerequest.test.yml b/tests/application/splunk_protocol_impersonation_weak_encryption_simplerequest.test.yml new file mode 100644 index 0000000000..0243e65479 --- /dev/null +++ b/tests/application/splunk_protocol_impersonation_weak_encryption_simplerequest.test.yml @@ -0,0 +1,12 @@ +name: Splunk protocol impersonation weak encryption simplerequest Unit Test +tests: +- name: Splunk protocol impersonation weak encryption simplerequest + file: application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: splk_protocol_impersonation_weak_encryption_simplerequest.txt + data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1588.004/splunk/splk_protocol_impersonation_weak_encryption_simplerequest.txt + source: "/opt/splunk/var/log/splunk/splunkd.log" + sourcetype: splunkd From 89ee09b0f0bd0c3625d9c995593bac819f9cfebc Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Thu, 26 May 2022 07:50:10 -0700 Subject: [PATCH 013/148] fixedmacros --- macros/splk_cert_validation_tls.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/macros/splk_cert_validation_tls.yml b/macros/splk_cert_validation_tls.yml index b9b35ceeca..88fb51ec38 100644 --- a/macros/splk_cert_validation_tls.yml +++ b/macros/splk_cert_validation_tls.yml @@ -1,8 +1,8 @@ <<<<<<< HEAD -definition: index=_internal sourcetype=splunk_python source=/opt/splunk/var/log/splunk/python.log +definition: index=_internal sourcetype=splunk_python description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. -name: splunk_protocol_impersonation_weak_encryption_simplerequest +name: splunk_protocol_impersonation_weak_encryption_simplerequest ======= definition: index=_internal sourcetype=splunkd description: customer specific splunk configurations(eg- index, source, sourcetype). From 3f8d20e7b83e864b85301a7a83cb83121de5e109 Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Thu, 26 May 2022 07:54:23 -0700 Subject: [PATCH 014/148] macrofix --- macros/splk_cert_validation_tls.yml | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/macros/splk_cert_validation_tls.yml b/macros/splk_cert_validation_tls.yml index 88fb51ec38..81d3154034 100644 --- a/macros/splk_cert_validation_tls.yml +++ b/macros/splk_cert_validation_tls.yml @@ -1,11 +1,4 @@ -<<<<<<< HEAD -definition: index=_internal sourcetype=splunk_python +definition: index=_internal sourcetype=splunk_python description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. name: splunk_protocol_impersonation_weak_encryption_simplerequest -======= -definition: index=_internal sourcetype=splunkd -description: customer specific splunk configurations(eg- index, source, sourcetype). - Replace the macro definition with configurations for your Splunk Environmnent. -name: splunkd ->>>>>>> 7bd84418068bfb3989af7bca4491af2c2400d959 From 39ee01a256434a1b0eedeb1d3c26335350e0f16a Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Thu, 26 May 2022 08:04:57 -0700 Subject: [PATCH 015/148] datasetx --- ...unk_protocol_impersonation_weak_encryption_simplerequest.yml | 2 +- ...rotocol_impersonation_weak_encryption_simplerequest.test.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index 969e007c41..f2722887dd 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -20,7 +20,7 @@ tags: context: - Source:Endpoint dataset: - - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1588.004/splunk/splk_protocol_impersonation_weak_encryption_simplerequest.txt + - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splk_protocol_impersonation_weak_encryption_simplerequest.txt impact: 50 kill_chain_phases: - Exploitation diff --git a/tests/application/splunk_protocol_impersonation_weak_encryption_simplerequest.test.yml b/tests/application/splunk_protocol_impersonation_weak_encryption_simplerequest.test.yml index 0243e65479..12a800bf11 100644 --- a/tests/application/splunk_protocol_impersonation_weak_encryption_simplerequest.test.yml +++ b/tests/application/splunk_protocol_impersonation_weak_encryption_simplerequest.test.yml @@ -7,6 +7,6 @@ tests: latest_time: now attack_data: - file_name: splk_protocol_impersonation_weak_encryption_simplerequest.txt - data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1588.004/splunk/splk_protocol_impersonation_weak_encryption_simplerequest.txt + data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splk_protocol_impersonation_weak_encryption_simplerequest.txt source: "/opt/splunk/var/log/splunk/splunkd.log" sourcetype: splunkd From a766811c5661a13719218e0b108826eabd2affe7 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 26 May 2022 10:32:09 -0500 Subject: [PATCH 016/148] 0602 hunt --- ...al_certificates_infrastructure_version.yml | 47 +++++++++++++++++++ ...rtificates_infrastructure_version.test.yml | 13 +++++ 2 files changed, 60 insertions(+) create mode 100644 detections/application/splunk_digital_certificates_infrastructure_version.yml create mode 100644 tests/application/splunk_digital_certificates_infrastructure_version.test.yml diff --git a/detections/application/splunk_digital_certificates_infrastructure_version.yml b/detections/application/splunk_digital_certificates_infrastructure_version.yml new file mode 100644 index 0000000000..5a645b2f29 --- /dev/null +++ b/detections/application/splunk_digital_certificates_infrastructure_version.yml @@ -0,0 +1,47 @@ +name: Splunk Digital Certificates Infrastructure Version +id: 3c162281-7edb-4ebc-b9a4-5087aaf28fa7 +version: 1 +date: '2022-05-26' +author: Lou Stella, Splunk +type: Hunting +datamodel: [] +description: On June 10th, 2022, Splunk released a security advisory relating to TLS validation occuring between different parts of Splunk Enterprise Infrastructure. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. +search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="sslConfig"| table splunk_server sslVerifyServerCert sslVerifyServerName serverCert] | fillnull value="Not Set" | rename sslVerifyServerCert as "Server.conf:SslConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:SslConfig:sslVerifyServerName", serverCert as "Server.conf:SslConfig:serverCert" | `splunk_digital_certificates_infrastructure_version_filter`' +how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers. +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk-to-Splunk_communication +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 100 + context: + - Source:Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log + impact: 50 + kill_chain_phases: + - Exploitation + message: $splunk_server$ may not be properly validating TLS Certificates + mitre_attack_id: + - T1587.003 + nist: + - DE.CM + observable: + - name: splunk_server + type: hostname + role: + - victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - none + risk_score: 50 + security_domain: threat diff --git a/tests/application/splunk_digital_certificates_infrastructure_version.test.yml b/tests/application/splunk_digital_certificates_infrastructure_version.test.yml new file mode 100644 index 0000000000..0e4f63363b --- /dev/null +++ b/tests/application/splunk_digital_certificates_infrastructure_version.test.yml @@ -0,0 +1,13 @@ +name: Splunk Digital Certificates Infrastructure Version Unit Test +tests: +- name: Splunk Digital Certificates Infrastructure Version + file: application/splunk_digital_certificates_infrastructure_version.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log + source: audittrail + sourcetype: audittrail + update_timestamp: true From 44a1886061da1428b3a46cbb6e8b53d43e96e4c4 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 26 May 2022 10:32:49 -0500 Subject: [PATCH 017/148] Missing field --- .../splunk_digital_certificates_infrastructure_version.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_digital_certificates_infrastructure_version.yml b/detections/application/splunk_digital_certificates_infrastructure_version.yml index 5a645b2f29..5bea317b56 100644 --- a/detections/application/splunk_digital_certificates_infrastructure_version.yml +++ b/detections/application/splunk_digital_certificates_infrastructure_version.yml @@ -8,7 +8,7 @@ datamodel: [] description: On June 10th, 2022, Splunk released a security advisory relating to TLS validation occuring between different parts of Splunk Enterprise Infrastructure. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="sslConfig"| table splunk_server sslVerifyServerCert sslVerifyServerName serverCert] | fillnull value="Not Set" | rename sslVerifyServerCert as "Server.conf:SslConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:SslConfig:sslVerifyServerName", serverCert as "Server.conf:SslConfig:serverCert" | `splunk_digital_certificates_infrastructure_version_filter`' how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers. -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +known_false_positives: No known at this time. references: - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk-to-Splunk_communication tags: From 92037c5992df5df7590a25a3ce2c4644b760ddd8 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 26 May 2022 11:39:00 -0500 Subject: [PATCH 018/148] deployment server --- ...s_injection_forwarder_bundle_downloads.yml | 52 +++++++++++++++++++ ...ection_forwarder_bundle_downloads.test.yml | 13 +++++ 2 files changed, 65 insertions(+) create mode 100644 detections/application/splunk_process_injection_forwarder_bundle_downloads.yml create mode 100644 tests/application/splunk_process_injection_forwarder_bundle_downloads.test.yml diff --git a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml new file mode 100644 index 0000000000..17cf657ae4 --- /dev/null +++ b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml @@ -0,0 +1,52 @@ +name: Splunk Process Injection Forwarder Bundle Downloads +id: 8ea57d78-1aac-45d2-a913-0cd603fb6e9e +version: 1 +date: '2022-05-26' +author: Lou Stella, Splunk +type: Hunting +datamodel: [] +description: On June 10th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. This hunting search pulls a full list of forwarder bundle downloads where peer is the forwarder, host is the Deployment Server, and then you have a list of the apps downloaded and the serverclasses in which the peer is a member of. You should look for apps or clients that you do not recognize as being part of your environment. +search: '`splunkd` component="PackageDownloadRestHandler" | stats values(app) values(serverclass) by peer, host | `splunk_process_injection_forwarder_bundle_downloads_filter`' +how_to_implement: This hunting search uses native logs produced when a deployment server is within your environment. +known_false_positives: None at this time. +references: +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0608.html +tags: + analytic_story: + - Splunk Vulnerabilites + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 75 + context: + - Source:Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/splunk_ds/splunkd.log + impact: 50 + kill_chain_phases: + - Exploitation + message: $peer$ downloaded apps from $host$ + mitre_attack_id: + - T1055 + nist: + - DE.CM + observable: + - name: host + type: hostname + role: + - victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - component + - app + - serverclass + - peer + - host + risk_score: 37 + security_domain: threat diff --git a/tests/application/splunk_process_injection_forwarder_bundle_downloads.test.yml b/tests/application/splunk_process_injection_forwarder_bundle_downloads.test.yml new file mode 100644 index 0000000000..ebe74285c3 --- /dev/null +++ b/tests/application/splunk_process_injection_forwarder_bundle_downloads.test.yml @@ -0,0 +1,13 @@ +name: Splunk Process Injection Forwarder Bundle Downloads Unit Test +tests: +- name: Splunk Process Injection Forwarder Bundle Downloads + file: application/splunk_process_injection_forwarder_bundle_downloads.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: splunkd.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/splunk_ds/splunkd.log + source: "/opt/splunk/var/log/splunk/splunkd.log" + sourcetype: splunkd + update_timestamp: false From ef9c0ab6966f03bc2499cccfeacfb77d492c1709 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 26 May 2022 11:40:47 -0500 Subject: [PATCH 019/148] Updated references --- .../splunk_digital_certificates_infrastructure_version.yml | 1 + ...lunk_protocol_impersonation_weak_encryption_configuration.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/detections/application/splunk_digital_certificates_infrastructure_version.yml b/detections/application/splunk_digital_certificates_infrastructure_version.yml index 5bea317b56..eed19e1c7e 100644 --- a/detections/application/splunk_digital_certificates_infrastructure_version.yml +++ b/detections/application/splunk_digital_certificates_infrastructure_version.yml @@ -11,6 +11,7 @@ how_to_implement: The user running this search is required to have a permission known_false_positives: No known at this time. references: - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk-to-Splunk_communication +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0602.html tags: analytic_story: - Splunk Vulnerabilities diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index e3f2dfbc9a..7ccd69f476 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -11,6 +11,7 @@ how_to_implement: The user running this search is required to have a permission known_false_positives: While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration. references: - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html tags: analytic_story: - Splunk Vulnerabilities From 76f9fe7bbda8b63db349424899653577f5c40364 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 26 May 2022 11:55:26 -0500 Subject: [PATCH 020/148] Updated validation issues --- .../splunk_digital_certificates_infrastructure_version.yml | 2 +- .../splunk_process_injection_forwarder_bundle_downloads.yml | 6 +++--- ...protocol_impersonation_weak_encryption_configuration.yml | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/application/splunk_digital_certificates_infrastructure_version.yml b/detections/application/splunk_digital_certificates_infrastructure_version.yml index eed19e1c7e..34af5dc48d 100644 --- a/detections/application/splunk_digital_certificates_infrastructure_version.yml +++ b/detections/application/splunk_digital_certificates_infrastructure_version.yml @@ -35,7 +35,7 @@ tags: - DE.CM observable: - name: splunk_server - type: hostname + type: Hostname role: - victim product: diff --git a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml index 17cf657ae4..adba811768 100644 --- a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml +++ b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml @@ -20,7 +20,7 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: 75 + confidence: 70 context: - Source:Endpoint dataset: @@ -35,7 +35,7 @@ tags: - DE.CM observable: - name: host - type: hostname + type: Hostname role: - victim product: @@ -48,5 +48,5 @@ tags: - serverclass - peer - host - risk_score: 37 + risk_score: 35 security_domain: threat diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index 7ccd69f476..ded2d69f49 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -35,7 +35,7 @@ tags: - DE.CM observable: - name: splunk_server - type: hostname + type: Hostname role: - victim product: From 522e569cedae2e3cf718df73829f9ff3c5d05855 Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Thu, 26 May 2022 09:58:07 -0700 Subject: [PATCH 021/148] splkselfsigneddetection --- ...personation_weak_encryption_selfsigned.yml | 41 +++++++++++++++++++ .../splk_cert_validation_tls_selfsigned.yml | 4 ++ ...nation_weak_encryption_selfsigned.test.yml | 12 ++++++ 3 files changed, 57 insertions(+) create mode 100644 detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml create mode 100644 macros/splk_cert_validation_tls_selfsigned.yml create mode 100644 tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml new file mode 100644 index 0000000000..cf64ca56c2 --- /dev/null +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -0,0 +1,41 @@ +name: Splunk protocol impersonation weak encryption selfsigned +id: c76c7a2e-df49-414a-bb36-dce2683770de +version: 1 +date: '2022-05-26' +author: Rod Soto, Splunk +type: Hunting +datamodel: [] +search: '|index=_internal sourcetype="splunkd" certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | splunk_protocol_impersonation_weak_encryption_selfsigned_filter' +description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates. +how_to_implement: Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. +known_false_positives: This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward. +references: +- https://www.splunk.com/en_us/product-security +- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Endpoint + confidence: 80 + context: + - Source:Endpoint + dataset: + - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splunk_protocol_impersonation_weak_encryption_selfsigned.txt + message: Splunk default issued certificate at host$ + mitre_attack_id: + - T1588.004 + observable: + - name: Hostname + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - host + - CN + - event_message + risk_score: 40 + security_domain: threat diff --git a/macros/splk_cert_validation_tls_selfsigned.yml b/macros/splk_cert_validation_tls_selfsigned.yml new file mode 100644 index 0000000000..2a9c676d9d --- /dev/null +++ b/macros/splk_cert_validation_tls_selfsigned.yml @@ -0,0 +1,4 @@ +definition: index=_internal sourcetype=splunkd +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: splunk_protocol_impersonation_weak_encryption_selfsigned diff --git a/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml b/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml new file mode 100644 index 0000000000..12a800bf11 --- /dev/null +++ b/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml @@ -0,0 +1,12 @@ +name: Splunk protocol impersonation weak encryption simplerequest Unit Test +tests: +- name: Splunk protocol impersonation weak encryption simplerequest + file: application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: splk_protocol_impersonation_weak_encryption_simplerequest.txt + data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splk_protocol_impersonation_weak_encryption_simplerequest.txt + source: "/opt/splunk/var/log/splunk/splunkd.log" + sourcetype: splunkd From 234be83ef15851f23e7f1cb8ea1017e99677e9b4 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 26 May 2022 12:05:14 -0500 Subject: [PATCH 022/148] Updated observable --- .../splunk_digital_certificates_infrastructure_version.yml | 2 +- .../splunk_process_injection_forwarder_bundle_downloads.yml | 2 +- ...unk_protocol_impersonation_weak_encryption_configuration.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/application/splunk_digital_certificates_infrastructure_version.yml b/detections/application/splunk_digital_certificates_infrastructure_version.yml index 34af5dc48d..a053b6a5fe 100644 --- a/detections/application/splunk_digital_certificates_infrastructure_version.yml +++ b/detections/application/splunk_digital_certificates_infrastructure_version.yml @@ -37,7 +37,7 @@ tags: - name: splunk_server type: Hostname role: - - victim + - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml index adba811768..c777653269 100644 --- a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml +++ b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml @@ -37,7 +37,7 @@ tags: - name: host type: Hostname role: - - victim + - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index ded2d69f49..ad0c8be65c 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -37,7 +37,7 @@ tags: - name: splunk_server type: Hostname role: - - victim + - Victim product: - Splunk Enterprise - Splunk Enterprise Security From d0e6ef17ced454030c2c58672262049b98d938e9 Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Thu, 26 May 2022 10:08:38 -0700 Subject: [PATCH 023/148] fixedmacros --- ...splunk_protocol_impersonation_weak_encryption_selfsigned.yml | 2 +- ...unk_protocol_impersonation_weak_encryption_simplerequest.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml index cf64ca56c2..96ef38797f 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -5,7 +5,7 @@ date: '2022-05-26' author: Rod Soto, Splunk type: Hunting datamodel: [] -search: '|index=_internal sourcetype="splunkd" certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | splunk_protocol_impersonation_weak_encryption_selfsigned_filter' +search: '| `splk_cert_validation_tls_selfsigned` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | splunk_protocol_impersonation_weak_encryption_selfsigned_filter' description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. known_false_positives: This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward. diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index f2722887dd..3e950747b4 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -5,7 +5,7 @@ date: '2022-05-24' author: Rod Soto, Splunk type: Hunting datamodel: [] -search: '|splk_cert_validation_tls "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | splunk_protocol_impersonation_weak_encryption_simplerequest_filter' +search: '| `splk_cert_validation_tls` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | splunk_protocol_impersonation_weak_encryption_simplerequest_filter' description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store.This search warns about failure to validate certification using python3 request. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. From 2a9d78d7fda3423dac4f0376ec1a203125744f8f Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Thu, 26 May 2022 10:16:31 -0700 Subject: [PATCH 024/148] fixedimpact --- .../splunk_protocol_impersonation_weak_encryption_selfsigned.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml index 96ef38797f..b4a0cdae42 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -21,6 +21,7 @@ tags: - Source:Endpoint dataset: - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splunk_protocol_impersonation_weak_encryption_selfsigned.txt + impact: 50 message: Splunk default issued certificate at host$ mitre_attack_id: - T1588.004 From d43d0ce270ebc49f49f03b4c26ff3f3bdb706f6a Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Thu, 26 May 2022 10:18:53 -0700 Subject: [PATCH 025/148] killchain --- ...splunk_protocol_impersonation_weak_encryption_selfsigned.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml index b4a0cdae42..4987ba912a 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -22,6 +22,8 @@ tags: dataset: - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splunk_protocol_impersonation_weak_encryption_selfsigned.txt impact: 50 + kill_chain_phases: + - Exploitation message: Splunk default issued certificate at host$ mitre_attack_id: - T1588.004 From 7d2a728085976bb5d0eb7635b3ddff63cf5a2094 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 26 May 2022 12:21:20 -0500 Subject: [PATCH 026/148] anomaly for non TLS forwarders --- ...igital_certificates_lack_of_encryption.yml | 53 +++++++++++++++++++ ...l_certificates_lack_of_encryption.test.yml | 13 +++++ 2 files changed, 66 insertions(+) create mode 100644 detections/application/splunk_digital_certificates_lack_of_encryption.yml create mode 100644 tests/application/splunk_digital_certificates_lack_of_encryption.test.yml diff --git a/detections/application/splunk_digital_certificates_lack_of_encryption.yml b/detections/application/splunk_digital_certificates_lack_of_encryption.yml new file mode 100644 index 0000000000..56daf54a7a --- /dev/null +++ b/detections/application/splunk_digital_certificates_lack_of_encryption.yml @@ -0,0 +1,53 @@ +name: Splunk Digital Certificates Lack of Encryption +id: 386a7ebc-737b-48cf-9ca8-5405459ed508 +version: 1 +date: '2022-05-26' +author: Lou Stella, Splunk +type: Anomaly +datamodel: [] +description: On June 10th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. The fixes for these require upgrading to at least Splunk 9.0 on the forwarder as well. This is a great opportunity to configure TLS across the environment. This search looks for forwarders that are not using TLS and adds risk to those entities. +search: '| `splunkd` group="tcpin_connections" ssl="false" | stats values(sourceIp) latest(fwdType) latest(version) by hostname | `splunk_digital_certificates_lack_of_encryption_filter`' +how_to_implement: This anomaly search looks for forwarder connections that are not currently using TLS. It then presents the source IP, the type of forwarder, and the version of the forwarder. You can also remove the "ssl=false" argument from the initial stanza in order to get a full list of all your forwarders that are sending data, and the version of Splunk software they are running, for audit purposes. +known_false_positives: None at this time +references: +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0608.html +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1587.003/splunk_fwder/splunkd.log + impact: 25 + kill_chain_phases: + - Exploitation + message: $hostname$ is not using TLS when forwarding data + mitre_attack_id: + - T1587.003 + nist: + - DE.CM + observable: + - name: hostname + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - group + - ssl + - sourceIp + - fwdType + - version + - hostname + risk_score: 20 + security_domain: threat diff --git a/tests/application/splunk_digital_certificates_lack_of_encryption.test.yml b/tests/application/splunk_digital_certificates_lack_of_encryption.test.yml new file mode 100644 index 0000000000..6fc83c2e2f --- /dev/null +++ b/tests/application/splunk_digital_certificates_lack_of_encryption.test.yml @@ -0,0 +1,13 @@ +name: Splunk Digital Certificates Lack of Encryption Unit Test +tests: +- name: Splunk Digital Certificates Lack of Encryption + file: application/splunk_digital_certificates_lack_of_encryption.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: splunkd.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1587.003/splunk_fwder/splunkd.log + source: "/opt/splunk/var/log/splunk/metrics.log" + sourcetype: splunkd + update_timestamp: false From 21d5a68dd9f5bc29d2e102954f8bfa70c70929f2 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 26 May 2022 11:28:08 -0600 Subject: [PATCH 027/148] Splunk Command and Scripting Interpreter Risky Commands --- ...d_scripting_interpreter_risky_commands.yml | 63 +++++++++++++++++++ ...rtificates_infrastructure_version.test.yml | 1 + 2 files changed, 64 insertions(+) create mode 100644 detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml new file mode 100644 index 0000000000..281f6ffbe0 --- /dev/null +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml @@ -0,0 +1,63 @@ +name: Splunk Command and Scripting Interpreter Risky Commands +id: 1cf58ae1-9177-40b8-a26c-8966040f11ae +version: 1 +date: '2022-05-23' +author: Michael Haag, Splunk +type: Hunting +datamodel: +- Endpoint +description: 'The Splunk platform contains built-in search processing language (SPL) safeguards to warn you when you are about to unknowingly run a search that contains commands that might be a security risk. This warning appears when you click a link or type a URL that loads a search that contains risky commands. The warning does not appear when you create ad hoc searches. This warning alerts you to the possibility of unauthorized actions by a malicious user. Unauthorized actions include - + Copying or transferring data (data exfiltration), Deleting data and Overwriting data. + A possible scenario when this might occur is when a malicious person creates a search that includes commands that exfiltrate or damage data. The malicious person then sends an unsuspecting user a link to the search. The URL contains a query string (q) and a search identifier (sid), but the sid is not valid. The malicious person hopes the user will use the link and the search will run. + During analysis, pivot based on user name and filter any user or queries not needed. Adhoc queries found from dashboards, however in audittrail logs it does not show the dashboard name. The query defaults to adhoc and no Splunk system user activity.' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*runshellscript*", "*collect*","*delete*", "*fit*", "*outputcsv*", "*outputlookup*", "*run*", "*script*", "*sendalert*", "*sendemail*", "*tscollect*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user + by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.savedsearch_name Search_Activity.search_type + | `drop_dm_object_name(Splunk_Audit)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `splunk_command_and_scripting_interpreter_risky_commands_filter`' +how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. +known_false_positives: False positives will be present until properly filtered by Username, search name, and so forth. +references: +- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Web Server + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 40 + context: + - Source:Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log + impact: 50 + kill_chain_phases: + - Actions on Objectives + message: A risky Splunk command has ran by $user$ and should be reviewed. + mitre_attack_id: + - T1213 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Search_Activity.search + - Search_Activity.info + - Search_Activity.total_run_time + - Search_Activity.user + - Search_Activity.savedsearch_name + - Search_Activity.search_type + risk_score: 20 + security_domain: audit + \ No newline at end of file diff --git a/tests/application/splunk_digital_certificates_infrastructure_version.test.yml b/tests/application/splunk_digital_certificates_infrastructure_version.test.yml index 0e4f63363b..a65603b137 100644 --- a/tests/application/splunk_digital_certificates_infrastructure_version.test.yml +++ b/tests/application/splunk_digital_certificates_infrastructure_version.test.yml @@ -11,3 +11,4 @@ tests: source: audittrail sourcetype: audittrail update_timestamp: true + From fb25e4def0969ca9077ccda0c317371e59b90e08 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 26 May 2022 11:38:35 -0600 Subject: [PATCH 028/148] Splunk Command and Scripting Interpreter Risky Commands --- ...nd_scripting_interpreter_risky_commands.test.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 tests/application/splunk_command_and_scripting_interpreter_risky_commands.test.yml diff --git a/tests/application/splunk_command_and_scripting_interpreter_risky_commands.test.yml b/tests/application/splunk_command_and_scripting_interpreter_risky_commands.test.yml new file mode 100644 index 0000000000..81490c8a0e --- /dev/null +++ b/tests/application/splunk_command_and_scripting_interpreter_risky_commands.test.yml @@ -0,0 +1,13 @@ +name: Splunk Command and Scripting Interpreter Risky Commands Unit Test +tests: +- name: Splunk Command and Scripting Interpreter Risky Commands + file: application/splunk_command_and_scripting_interpreter_risky_commands.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: audittrail.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log + source: audittrail + sourcetype: audittrail + update_timestamp: true From d807ca429a1bfc19ce7a317e91266a52b3370376 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 26 May 2022 12:46:34 -0500 Subject: [PATCH 029/148] Updating MITRE ATT&CK --- detections/endpoint/linux_at_application_execution.yml | 2 +- .../linux_possible_append_command_to_at_allow_config_file.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/linux_at_application_execution.yml b/detections/endpoint/linux_at_application_execution.yml index 34d7f80af6..5e00bb941a 100644 --- a/detections/endpoint/linux_at_application_execution.yml +++ b/detections/endpoint/linux_at_application_execution.yml @@ -48,7 +48,7 @@ tags: - Exploitation message: At application was executed in $dest$ mitre_attack_id: - - T1053.001 + - T1053.002 - T1053 nist: - DE.CM diff --git a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml index a23a4f5174..03fba912bf 100644 --- a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml +++ b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml @@ -49,7 +49,7 @@ tags: - Exploitation message: A commandline $process$ that may modify at allow config file in $dest$ mitre_attack_id: - - T1053.001 + - T1053.002 - T1053 nist: - DE.CM From e6dcc82562c08ea6b2e484a09bd3071fa06b8cec Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 26 May 2022 12:52:42 -0500 Subject: [PATCH 030/148] Updating tactic --- detections/endpoint/macos_plutil.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/macos_plutil.yml b/detections/endpoint/macos_plutil.yml index 3401678938..a847e5eb7d 100644 --- a/detections/endpoint/macos_plutil.yml +++ b/detections/endpoint/macos_plutil.yml @@ -39,7 +39,7 @@ tags: - Actions on Objectives message: plutil are executed on $host$ from $user$ mitre_attack_id: - - T1547.011 + - T1647 nist: - DE.CM observable: From 6ddebf3a2d21dc0c71faf18f553ad12c6cbf447e Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 26 May 2022 12:28:21 -0600 Subject: [PATCH 031/148] ssl tls ver --- ...splunk_identified_ssl_tls_certificates.yml | 54 +++++++++++++++++++ ...k_identified_ssl_tls_certificates.test.yml | 13 +++++ 2 files changed, 67 insertions(+) create mode 100644 detections/network/splunk_identified_ssl_tls_certificates.yml create mode 100644 tests/network/splunk_identified_ssl_tls_certificates.test.yml diff --git a/detections/network/splunk_identified_ssl_tls_certificates.yml b/detections/network/splunk_identified_ssl_tls_certificates.yml new file mode 100644 index 0000000000..71a7988185 --- /dev/null +++ b/detections/network/splunk_identified_ssl_tls_certificates.yml @@ -0,0 +1,54 @@ +name: Splunk Identified SSL TLS Certificates +id: 620fbb89-86fd-4e2e-925f-738374277586 +version: 1 +date: '2022-05-25' +author: Michael Haag, Splunk +type: Hunting +datamodel: +- Network_Traffic +description: The following analytic uses tags of SSL, TLS and certificate to identify the usage of the Splunk default certificates being utilized in the environment. Recommended guidance to utilize valid TLS certificates which documentation may be found in Splunk Docs - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL. +search: 'tag IN (ssl, tls, certificate) ssl_issuer_common_name=*splunk* | stats values(src) AS "Host(s) with Default Cert" count by ssl_issuer ssl_subject_common_name ssl_subject_organization ssl_subject host sourcetype + | `splunk_identified_ssl_tls_certificates_filter`' +how_to_implement: Ingestion of SSL/TLS data is needed and to be tagged properly as ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams. +known_false_positives: False positives will not be present as it is meant to assist with identifying default certificates being utilized. +references: + - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Proxy + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 100 + context: + - Source:Application Log + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1040/ssltls/ssl_splunk.log + impact: 100 + kill_chain_phases: + - Reconnaissance + message: The following $dest$ is using the self signed Splunk certificate. + mitre_attack_id: + - T1040 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - ssl_issuer + - ssl_subject_common_name + - ssl_subject_organization + - ssl_subject + - host + - sourcetype + risk_score: 100 + security_domain: network \ No newline at end of file diff --git a/tests/network/splunk_identified_ssl_tls_certificates.test.yml b/tests/network/splunk_identified_ssl_tls_certificates.test.yml new file mode 100644 index 0000000000..fb43c99049 --- /dev/null +++ b/tests/network/splunk_identified_ssl_tls_certificates.test.yml @@ -0,0 +1,13 @@ +name: Splunk Identified SSL TLS Certificates Unit Test +tests: +- name: Splunk Identified SSL TLS Certificates + file: network/splunk_identified_ssl_tls_certificates.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: ssl_splunk.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1040/ssltls/ssl_splunk.log + source: stream:tcp + sourcetype: stream:tcp + update_timestamp: true From 177a9736d3813b5f6d46fe4520c3b3fa677bcf2c Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 27 May 2022 14:25:20 -0600 Subject: [PATCH 032/148] Update splunk_command_and_scripting_interpreter_risky_commands.yml fixed --- ...unk_command_and_scripting_interpreter_risky_commands.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml index 281f6ffbe0..ee44e7f604 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml @@ -10,10 +10,10 @@ description: 'The Splunk platform contains built-in search processing language ( Copying or transferring data (data exfiltration), Deleting data and Overwriting data. A possible scenario when this might occur is when a malicious person creates a search that includes commands that exfiltrate or damage data. The malicious person then sends an unsuspecting user a link to the search. The URL contains a query string (q) and a search identifier (sid), but the sid is not valid. The malicious person hopes the user will use the link and the search will run. During analysis, pivot based on user name and filter any user or queries not needed. Adhoc queries found from dashboards, however in audittrail logs it does not show the dashboard name. The query defaults to adhoc and no Splunk system user activity.' -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*runshellscript*", "*collect*","*delete*", "*fit*", "*outputcsv*", "*outputlookup*", "*run*", "*script*", "*sendalert*", "*sendemail*", "*tscollect*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user - by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.savedsearch_name Search_Activity.search_type +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user + by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Splunk_Audit)` - | `security_content_ctime(firstTime)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_risky_commands_filter`' how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. From 926e63649ab557a453d282e61180b260cfd95f1f Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 27 May 2022 14:41:34 -0600 Subject: [PATCH 033/148] delete usage --- ...and_scripting_interpreter_delete_usage.yml | 60 +++++++++++++++++++ ...cripting_interpreter_delete_usage.test.yml | 14 +++++ 2 files changed, 74 insertions(+) create mode 100644 detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml create mode 100644 tests/application/splunk_command_and_scripting_interpreter_delete_usage.test.yml diff --git a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml new file mode 100644 index 0000000000..2bfdd6f358 --- /dev/null +++ b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml @@ -0,0 +1,60 @@ +name: Splunk Command and Scripting Interpreter Delete Usage +id: 8d3d5d5e-ca43-42be-aa1f-bc64375f6b04 +version: 1 +date: '2022-05-27' +author: Michael Haag, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic identifies the use of the risky command - Delete - that may be utilized in Splunk to delete some or all data queried for. In order to use Delete in Splunk, one must be assigned the role. This is typically not used and should generate an anomaly if it is used. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| delete*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user + by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type + | `drop_dm_object_name(Splunk_Audit)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `splunk_command_and_scripting_interpreter_delete_usage_filter`' +how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. +known_false_positives: False positives may be present if this command is used as a common practive. Filter as needed. +references: +- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Web Server + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 100 + context: + - Source:Endpoint + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log + impact: 100 + kill_chain_phases: + - Actions on Objectives + message: Delete command has ran by $user$ and should be reviewed. + mitre_attack_id: + - T1213 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Search_Activity.search + - Search_Activity.info + - Search_Activity.total_run_time + - Search_Activity.user + - Search_Activity.savedsearch_name + - Search_Activity.search_type + risk_score: 100 + security_domain: audit + \ No newline at end of file diff --git a/tests/application/splunk_command_and_scripting_interpreter_delete_usage.test.yml b/tests/application/splunk_command_and_scripting_interpreter_delete_usage.test.yml new file mode 100644 index 0000000000..a44479a465 --- /dev/null +++ b/tests/application/splunk_command_and_scripting_interpreter_delete_usage.test.yml @@ -0,0 +1,14 @@ +name: Splunk Command and Scripting Interpreter Delete Usage Unit Test +tests: +- name: Splunk Command and Scripting Interpreter Delete Usage + file: application/splunk_command_and_scripting_interpreter_delete_usage.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: audittrail.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log + source: audittrail + sourcetype: audittrail + update_timestamp: true + update_timestamp: true From ce599810c6f65f68bd1326b8496c1e7b19d3ba62 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 27 May 2022 15:00:35 -0600 Subject: [PATCH 034/148] confidence --- ...splunk_command_and_scripting_interpreter_risky_commands.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml index ee44e7f604..84d03de18b 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml @@ -9,7 +9,8 @@ datamodel: description: 'The Splunk platform contains built-in search processing language (SPL) safeguards to warn you when you are about to unknowingly run a search that contains commands that might be a security risk. This warning appears when you click a link or type a URL that loads a search that contains risky commands. The warning does not appear when you create ad hoc searches. This warning alerts you to the possibility of unauthorized actions by a malicious user. Unauthorized actions include - Copying or transferring data (data exfiltration), Deleting data and Overwriting data. A possible scenario when this might occur is when a malicious person creates a search that includes commands that exfiltrate or damage data. The malicious person then sends an unsuspecting user a link to the search. The URL contains a query string (q) and a search identifier (sid), but the sid is not valid. The malicious person hopes the user will use the link and the search will run. - During analysis, pivot based on user name and filter any user or queries not needed. Adhoc queries found from dashboards, however in audittrail logs it does not show the dashboard name. The query defaults to adhoc and no Splunk system user activity.' + During analysis, pivot based on user name and filter any user or queries not needed. Adhoc queries found from dashboards, however in audittrail logs it does not show the dashboard name. The query defaults to adhoc and no Splunk system user activity. + In addition, modify this query by removing key commands that generate too much noise, or too little, and create separate queries with higher confidence to alert on.' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Splunk_Audit)` From 0c74525449e91ea587a4b02f4ab1824d8afc4b3f Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 27 May 2022 14:33:29 -0700 Subject: [PATCH 035/148] Updated the following apps: Splunk Add on for Microsoft Windows Splunk Add on for Unix and Linux Splunk Stream Splunk Stream Knowledge Objects for Wire Data Splunk Stream Add On Splunk Add on for Microsoft Office 365 Splunk Common Information Model --- .../test_config_github_actions.json | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json index 36fc631670..31ce39ea11 100644 --- a/bin/docker_detection_tester/test_config_github_actions.json +++ b/bin/docker_detection_tester/test_config_github_actions.json @@ -22,13 +22,13 @@ }, "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": { "app_number": 4055, - "app_version": "2.2.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_220.tgz" + "app_version": "3.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_300.tgz" }, "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": { "app_number": 742, - "app_version": "8.4.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_840.tgz" + "app_version": "8.5.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz" }, "SPLUNK_ADD_ON_FOR_NGINX": { "app_number": 3258, @@ -37,13 +37,13 @@ }, "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": { "app_number": 5238, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_801.tgz" + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_802.tgz" }, "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": { "app_number": 5234, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_801.tgz" + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_802.tgz" }, "SPLUNK_ADD_ON_FOR_SYSMON": { "app_number": 5709, @@ -52,18 +52,18 @@ }, "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": { "app_number": 833, - "app_version": "8.4.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_840.tgz" + "app_version": "8.5.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_850.tgz" }, "SPLUNK_APP_FOR_STREAM": { "app_number": 1809, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_801.tgz" + "app_version": "8.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_802.tgz" }, "SPLUNK_COMMON_INFORMATION_MODEL": { "app_number": 1621, - "app_version": "5.0.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_500.tgz" + "app_version": "5.0.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_501.tgz" }, "SPLUNK_ES_CONTENT_UPDATE": { "app_number": 3449, From bc4e55c32ae0162b25bf12c6a05de34689806fb3 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 27 May 2022 14:38:09 -0700 Subject: [PATCH 036/148] Revert "Updated the following apps:" This reverts commit 0c74525449e91ea587a4b02f4ab1824d8afc4b3f. --- .../test_config_github_actions.json | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json index 31ce39ea11..36fc631670 100644 --- a/bin/docker_detection_tester/test_config_github_actions.json +++ b/bin/docker_detection_tester/test_config_github_actions.json @@ -22,13 +22,13 @@ }, "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": { "app_number": 4055, - "app_version": "3.0.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_300.tgz" + "app_version": "2.2.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_220.tgz" }, "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": { "app_number": 742, - "app_version": "8.5.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz" + "app_version": "8.4.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_840.tgz" }, "SPLUNK_ADD_ON_FOR_NGINX": { "app_number": 3258, @@ -37,13 +37,13 @@ }, "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": { "app_number": 5238, - "app_version": "8.0.2", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_802.tgz" + "app_version": "8.0.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_801.tgz" }, "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": { "app_number": 5234, - "app_version": "8.0.2", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_802.tgz" + "app_version": "8.0.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_801.tgz" }, "SPLUNK_ADD_ON_FOR_SYSMON": { "app_number": 5709, @@ -52,18 +52,18 @@ }, "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": { "app_number": 833, - "app_version": "8.5.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_850.tgz" + "app_version": "8.4.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_840.tgz" }, "SPLUNK_APP_FOR_STREAM": { "app_number": 1809, - "app_version": "8.0.2", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_802.tgz" + "app_version": "8.0.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_801.tgz" }, "SPLUNK_COMMON_INFORMATION_MODEL": { "app_number": 1621, - "app_version": "5.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_501.tgz" + "app_version": "5.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_500.tgz" }, "SPLUNK_ES_CONTENT_UPDATE": { "app_number": 3449, From 25149833618ff3ca6d2869e7af217a68563f0f19 Mon Sep 17 00:00:00 2001 From: d1vious Date: Fri, 27 May 2022 20:33:28 -0400 Subject: [PATCH 037/148] adding a note about how the score is calculated --- .../adapter/templates/doc_detections.j2 | 10 +- docs/_pages/detections.md | 128 ++++++------- docs/_pages/stories.md | 94 +++++----- ...spectre_and_meltdown_vulnerable_systems.md | 8 +- ...12-detect_new_login_attempts_to_routers.md | 10 +- ...od_without_successful_netbackup_backups.md | 10 +- .../2017-09-12-identify_new_user_accounts.md | 8 +- ...17-09-12-unsuccessful_netbackup_backups.md | 10 +- ...tect_unauthorized_assets_by_mac_address.md | 10 +- ...9-15-no_windows_updates_in_a_time_frame.md | 10 +- ...9-email_attachments_with_lots_of_spaces.md | 10 +- .../2017-09-19-open_redirect_in_splunk_web.md | 8 +- ...7-09-20-large_volume_of_dns_any_queries.md | 10 +- ...s_scanning_for_vulnerable_jboss_servers.md | 10 +- ...cious_requests_to_exploit_jboss_servers.md | 10 +- .../2017-09-23-monitor_dns_for_brand_abuse.md | 8 +- ...-23-monitor_web_traffic_for_brand_abuse.md | 10 +- ...0-13-unusually_long_content-type_length.md | 10 +- .../2017-11-27-detect_usb_device_insertion.md | 8 +- ...018-01-05-monitor_email_for_brand_abuse.md | 10 +- ...nce_started_in_previously_unseen_region.md | 8 +- ...ance_started_with_previously_unseen_ami.md | 8 +- ...rovisioning_from_previously_unseen_city.md | 8 +- ...isioning_from_previously_unseen_country.md | 8 +- ...oning_from_previously_unseen_ip_address.md | 8 +- ...visioning_from_previously_unseen_region.md | 8 +- ...16-detect_new_api_calls_from_user_roles.md | 8 +- ...detect_spike_in_security_group_activity.md | 8 +- ..._blocked_outbound_traffic_from_your_aws.md | 10 +- ...ect_api_activity_from_users_without_mfa.md | 8 +- ...21-detect_spike_in_network_acl_activity.md | 10 +- ...6-01-detect_large_outbound_icmp_packets.md | 10 +- ...plunk_enterprise_information_disclosure.md | 8 +- ...18-06-28-detect_s3_access_from_a_new_ip.md | 12 +- ...18-10-08-web_fraud_-_account_harvesting.md | 8 +- ...8-web_fraud_-_anomalous_user_clickspeed.md | 8 +- ...raud_-_password_sharing_across_accounts.md | 8 +- ...ce_created_with_previously_unseen_image.md | 8 +- ...-10-23-wmi_permanent_event_subscription.md | 10 +- ...-10-23-wmi_temporary_event_subscription.md | 10 +- ...8-11-02-windows_hosts_file_modification.md | 8 +- ...1-27-detect_spike_in_s3_bucket_deletion.md | 10 +- .../2018-12-03-remote_wmi_command_attempt.md | 8 +- .../_posts/2018-12-03-usn_journal_deletion.md | 8 +- .../2018-12-06-suspicious_java_classes.md | 12 +- .../2018-12-14-file_with_samsam_extension.md | 8 +- .../2018-12-14-samsam_test_file_write.md | 8 +- ...01-25-processes_tapping_keyboard_events.md | 10 +- ...01-29-osquery_pack_-_coldroot_detection.md | 8 +- ...ikatz_via_powershell_and_eventcode_4703.md | 10 +- ...ide_files_directories_via_registry_keys.md | 8 +- ..._servers_executing_suspicious_processes.md | 10 +- .../2019-04-25-suspicious_file_write.md | 10 +- ...5-08-unusually_long_command_line_-_mltk.md | 10 +- ...9-10-11-prohibited_software_on_endpoint.md | 8 +- ...credential_dumping_through_lsass_access.md | 8 +- ...-03-detect_mimikatz_using_loaded_images.md | 8 +- ...6-access_lsass_memory_for_dump_creation.md | 8 +- ...9-12-06-create_remote_thread_into_lsass.md | 8 +- ...19-12-06-unsigned_image_loaded_by_lsass.md | 8 +- .../2019-12-10-creation_of_shadow_copy.md | 8 +- ...-01-22-dns_query_length_outliers_-_mltk.md | 10 +- ...0-01-28-auto_admin_logon_registry_entry.md | 8 +- ...onitor_registry_keys_for_print_monitors.md | 8 +- ...gistry_keys_for_creating_shim_databases.md | 8 +- docs/_posts/2020-01-28-sdclt_uac_bypass.md | 8 +- .../2020-01-28-silentcleanup_uac_bypass.md | 8 +- docs/_posts/2020-01-28-wsreset_uac_bypass.md | 8 +- ...-03-creation_of_lsass_dump_with_taskmgr.md | 8 +- ...ed_with_previously_unseen_instance_type.md | 8 +- ...20-02-07-macos_-_re-opened_applications.md | 10 +- .../2020-02-20-gcp_gcr_container_uploaded.md | 8 +- ...02-20-new_container_uploaded_to_aws_ecr.md | 10 +- .../2020-02-21-dump_lsass_via_comsvcs_dll.md | 12 +- ...03-02-remote_registry_key_modifications.md | 8 +- ...20-03-16-child_processes_of_spoolsv_exe.md | 10 +- .../2020-03-16-detect_rare_executables.md | 12 +- .../2020-03-16-process_execution_via_wmi.md | 8 +- .../2020-03-16-script_execution_via_wmi.md | 8 +- .../_posts/2020-03-16-spike_in_file_writes.md | 10 +- ...n_eks_kubernetes_cluster_scan_detection.md | 12 +- ...mazon_eks_kubernetes_pod_scan_detection.md | 12 +- ...5-gcp_kubernetes_cluster_scan_detection.md | 8 +- ...05-19-kubernetes_azure_scan_fingerprint.md | 8 +- ...0-first_time_seen_child_process_of_zoom.md | 10 +- ...es_azure_detect_sensitive_object_access.md | 8 +- ...etes_azure_detect_sensitive_role_access.md | 8 +- ...rvice_accounts_forbidden_failure_access.md | 8 +- ...0-kubernetes_azure_pod_scan_fingerprint.md | 8 +- ...ctive_service_accounts_by_pod_namespace.md | 8 +- ...re_detect_rbac_authorization_by_account.md | 8 +- ...s_azure_detect_suspicious_kubectl_calls.md | 8 +- ...activity_from_previously_unseen_account.md | 8 +- ...ernetes_cluster_sensitive_object_access.md | 8 +- ...ect_most_active_service_accounts_by_pod.md | 8 +- ...ws_detect_rbac_authorization_by_account.md | 8 +- ...rnetes_aws_detect_sensitive_role_access.md | 8 +- ...rvice_accounts_forbidden_failure_access.md | 8 +- ...tes_aws_detect_suspicious_kubectl_calls.md | 10 +- ...rvice_accounts_forbidden_failure_access.md | 8 +- ...interception_by_creation_of_program_exe.md | 8 +- ...2020-07-06-short_lived_windows_accounts.md | 8 +- .../2020-07-06-windows_event_log_cleared.md | 10 +- ...20-07-07-remote_desktop_network_traffic.md | 10 +- ...20-07-08-detect_new_local_admin_account.md | 10 +- ...ect_most_active_service_accounts_by_pod.md | 8 +- ...p_detect_rbac_authorizations_by_account.md | 8 +- ...etes_gcp_detect_sensitive_object_access.md | 8 +- ...rnetes_gcp_detect_sensitive_role_access.md | 8 +- ...tes_gcp_detect_suspicious_kubectl_calls.md | 8 +- ...p_kubernetes_cluster_pod_scan_detection.md | 10 +- ...lly_high_aws_instances_launched_by_user.md | 8 +- ...h_aws_instances_launched_by_user_-_mltk.md | 8 +- ...y_high_aws_instances_terminated_by_user.md | 8 +- ...aws_instances_terminated_by_user_-_mltk.md | 8 +- ...-07-21-attempt_to_stop_security_service.md | 10 +- ...ents_connecting_to_multiple_dns_servers.md | 14 +- ...api_activities_from_unapproved_accounts.md | 8 +- ..._to_phishing_sites_leveraging_evilginx2.md | 16 +- ...-detect_excessive_user_account_lockouts.md | 8 +- ...-21-detect_long_dns_txt_record_response.md | 14 +- ...07-21-detect_new_user_aws_console_login.md | 8 +- .../2020-07-21-detect_outbound_smb_traffic.md | 10 +- ...1-detect_outlook_exe_writing_a_zip_file.md | 10 +- ...-07-21-detect_spike_in_aws_api_activity.md | 8 +- ...f_cmd_exe_to_launch_script_interpreters.md | 8 +- ...web_traffic_to_dynamic_domain_providers.md | 8 +- ...-21-detection_of_tools_built_by_nirsoft.md | 10 +- ...ts_resolved_by_unauthorized_dns_servers.md | 8 +- docs/_posts/2020-07-21-dns_record_changed.md | 8 +- ...ce_modified_with_previously_unseen_user.md | 8 +- ...nce_started_with_previously_unseen_user.md | 8 +- ...ritten_outside_of_the_outlook_directory.md | 10 +- ...rs_sending_high_volume_traffic_to_hosts.md | 10 +- .../2020-07-21-excessive_dns_failures.md | 10 +- ...1-first_time_seen_command_line_argument.md | 8 +- ...first_time_seen_running_windows_service.md | 12 +- ...g_files_and_directories_with_attrib_exe.md | 8 +- ...me_of_network_traffic_from_email_server.md | 10 +- ...shell_process_-_execution_policy_bypass.md | 8 +- ...th_invalid_credentials_from_the_same_ip.md | 10 +- .../2020-07-21-okta_account_lockout_events.md | 10 +- .../2020-07-21-okta_failed_sso_attempts.md | 10 +- ...1-okta_user_logins_from_multiple_cities.md | 10 +- ...7-21-overwriting_accessibility_binaries.md | 8 +- ...7-21-prohibited_network_traffic_allowed.md | 10 +- .../2020-07-21-protocol_or_port_mismatch.md | 16 +- ...07-21-remote_desktop_network_bruteforce.md | 10 +- ...emote_desktop_process_running_on_system.md | 10 +- ...21-sc_exe_manipulating_windows_services.md | 8 +- ...uled_tasks_used_in_badrabbit_ransomware.md | 8 +- docs/_posts/2020-07-22-smb_traffic_spike.md | 10 +- .../2020-07-22-smb_traffic_spike_-_mltk.md | 10 +- ...suspicious_changes_to_file_associations.md | 8 +- ...20-07-22-suspicious_email_-_uba_anomaly.md | 8 +- ...-suspicious_email_attachment_extensions.md | 12 +- .../2020-07-22-suspicious_reg_exe_process.md | 8 +- ...ous_writes_to_system_volume_information.md | 8 +- ...uspicious_writes_to_windows_recycle_bin.md | 8 +- docs/_posts/2020-07-22-tor_traffic.md | 10 +- ...20-07-22-uncommon_processes_on_endpoint.md | 10 +- .../2020-07-22-unload_sysmon_filter_driver.md | 8 +- ...-07-27-aws_detect_attach_to_role_policy.md | 10 +- ...07-27-aws_detect_permanent_key_creation.md | 10 +- .../2020-07-27-aws_detect_role_creation.md | 10 +- ...-07-27-aws_detect_sts_assume_role_abuse.md | 10 +- ...-aws_detect_sts_get_session_token_abuse.md | 10 +- ...ct_windows_dns_sigred_via_splunk_stream.md | 12 +- ...7-28-detect_windows_dns_sigred_via_zeek.md | 10 +- ...ance_modified_by_previously_unseen_user.md | 8 +- ...-08-02-detect_f5_tmui_rce_cve-2020-5902.md | 10 +- ...-05-detect_new_open_gcp_storage_buckets.md | 10 +- ...detect_gcp_storage_access_from_a_new_ip.md | 10 +- .../_posts/2020-08-11-detect_arp_poisoning.md | 10 +- .../2020-08-11-detect_rogue_dhcp_server.md | 10 +- ...ivity_from_previously_unseen_ip_address.md | 8 +- ..._activity_from_previously_unseen_region.md | 8 +- ...igh_number_of_cloud_instances_destroyed.md | 10 +- ...high_number_of_cloud_instances_launched.md | 10 +- ...2020-09-01-gcp_detect_oauth_token_abuse.md | 8 +- ...nce_created_in_previously_unused_region.md | 8 +- ...calls_from_previously_unseen_user_roles.md | 8 +- ...umber_of_cloud_infrastructure_api_calls.md | 8 +- ...umber_of_cloud_security_group_api_calls.md | 8 +- ...oud_network_access_control_list_deleted.md | 8 +- ...ed_with_previously_unseen_instance_type.md | 8 +- .../2020-09-15-detect_zerologon_via_zeek.md | 10 +- ..._or_delete_windows_shares_using_net_exe.md | 10 +- ...computer_changed_with_anonymous_account.md | 10 +- ...aws_console_login_by_user_from_new_city.md | 8 +- ..._console_login_by_user_from_new_country.md | 8 +- ...s_console_login_by_user_from_new_region.md | 8 +- ...2020-10-08-gcp_detect_gcploit_framework.md | 10 +- ...ng_activity_from_previously_unseen_city.md | 8 +- ...activity_from_previously_unseen_country.md | 8 +- ...ccounts_with_high_risk_roles_by_project.md | 8 +- ...isk_permissions_by_resource_and_account.md | 8 +- ...tivity_related_to_pass_the_hash_attacks.md | 10 +- ...20-10-21-detect_snicat_sni_exfiltration.md | 10 +- ...ect_ipv6_network_infrastructure_threats.md | 10 +- ...20-10-28-detect_port_security_violation.md | 10 +- ...ect_software_download_to_network_device.md | 10 +- .../2020-10-28-detect_traffic_mirroring.md | 10 +- .../2020-11-06-ryuk_test_files_detected.md | 8 +- ...windows_connhost_exe_started_forcefully.md | 8 +- ...indows_security_account_manager_stopped.md | 8 +- ...2020-11-09-common_ransomware_extensions.md | 8 +- .../2020-11-09-common_ransomware_notes.md | 8 +- .../2020-11-09-deleting_shadow_copies.md | 8 +- ...xcessive_account_lockouts_from_endpoint.md | 8 +- ..._system_network_configuration_discovery.md | 8 +- ...rohibited_applications_spawning_cmd_exe.md | 12 +- ...8-disabling_remote_user_account_control.md | 8 +- ...cution_of_file_with_multiple_extensions.md | 8 +- ...on_of_file_with_spaces_before_extension.md | 8 +- .../2020-11-23-processes_created_by_netsh.md | 8 +- ...installation_with_suspicious_parameters.md | 8 +- ...pulating_windows_services_registry_keys.md | 8 +- ...2-07-schtasks_used_for_forcing_a_reboot.md | 8 +- .../2020-12-08-shim_database_file_creation.md | 8 +- ...12-08-single_letter_process_on_endpoint.md | 8 +- ...processes_run_from_unexpected_locations.md | 8 +- .../2020-12-08-unusually_long_command_line.md | 10 +- ...i_permanent_event_subscription_-_sysmon.md | 8 +- ...burst_correlation_dll_and_network_event.md | 10 +- ...12-15-o365_suspicious_rights_delegation.md | 8 +- ..._of_login_failures_from_a_single_source.md | 10 +- .../2020-12-16-o365_pst_export_alert.md | 8 +- ...-o365_suspicious_admin_email_forwarding.md | 8 +- ...6-o365_suspicious_user_email_forwarding.md | 8 +- ...1-bcdedit_failure_recovery_modification.md | 8 +- docs/_posts/2021-01-06-supernova_webshell.md | 10 +- ...ng_keys_with_encrypt_policy_without_mfa.md | 8 +- ..._with_kms_keys_performing_encryption_s3.md | 8 +- ...ontrol_list_created_with_all_open_ports.md | 8 +- ...aws_network_access_control_list_deleted.md | 8 +- ...cious_microsoft_workflow_compiler_usage.md | 12 +- .../2021-01-12-suspicious_msbuild_spawn.md | 12 +- ...21-01-12-suspicious_mshta_child_process.md | 14 +- ..._connecting_to_dynamic_domain_providers.md | 8 +- ...ell_process_with_obfuscation_techniques.md | 8 +- ...cious_powershell_command-line_arguments.md | 8 +- ...20-detect_rundll32_inline_hta_execution.md | 18 +- .../2021-01-20-suspicious_mshta_spawn.md | 16 +- ...021-01-22-wbadmin_delete_system_backups.md | 8 +- ...l_access_by_provider_user_and_principal.md | 8 +- ...01-26-aws_saml_update_identity_provider.md | 8 +- ...-26-certutil_exe_certificate_extraction.md | 8 +- ...ws_security_hub_alerts_for_ec2_instance.md | 8 +- ...ike_in_aws_security_hub_alerts_for_user.md | 10 +- ...o365_add_app_role_assignment_grant_user.md | 8 +- ...1-01-26-o365_excessive_sso_logon_errors.md | 8 +- ...1-01-26-o365_new_federated_domain_added.md | 8 +- .../_posts/2021-01-26-revil_registry_entry.md | 8 +- ...1-27-detect_baron_samedit_cve-2021-3156.md | 10 +- ...baron_samedit_cve-2021-3156_via_osquery.md | 10 +- ...ect_regsvr32_application_control_bypass.md | 14 +- .../_posts/2021-01-28-ntdsutil_export_ntds.md | 8 +- ...cious_regsvr32_register_suspicious_path.md | 14 +- ...ct_baron_samedit_cve-2021-3156_segfault.md | 10 +- ...21-02-01-dump_lsass_via_procdump_rename.md | 8 +- ...32_application_control_bypass_-_advpack.md | 18 +- ...2_application_control_bypass_-_setupapi.md | 18 +- ...2_application_control_bypass_-_syssetup.md | 18 +- .../2021-02-04-suspicious_rundll32_startw.md | 18 +- ...9-suspicious_rundll32_dllregisterserver.md | 18 +- ...11-detect_html_help_spawn_child_process.md | 14 +- ...-02-12-detect_regasm_spawning_a_process.md | 14 +- ...02-12-detect_regsvcs_spawning_a_process.md | 14 +- ...2-22-suspicious_curl_network_connection.md | 10 +- .../2021-02-22-suspicious_plistbuddy_usage.md | 10 +- ...suspicious_plistbuddy_usage_via_osquery.md | 10 +- ...uspicious_sqlite3_lsquarantine_behavior.md | 10 +- .../_posts/2021-03-01-fodhelper_uac_bypass.md | 8 +- .../2021-03-01-ryuk_wake_on_lan_command.md | 8 +- ...us_scheduled_task_from_public_directory.md | 8 +- .../2021-03-02-aws_setdefaultpolicyversion.md | 8 +- ...ed_messaging_service_spawning_a_process.md | 8 +- ...-02-windows_disableantispyware_registry.md | 8 +- ...2021-03-03-nishang_powershelltcponeline.md | 8 +- docs/_posts/2021-03-03-w3wp_spawning_shell.md | 12 +- ...21-03-12-ransomware_notes_bulk_creation.md | 8 +- .../2021-03-12-resize_shadowstorage_volume.md | 8 +- ...3-16-high_process_termination_frequency.md | 8 +- ...16-windows_high_file_deletion_frequency.md | 8 +- .../2021-03-17-clop_common_exec_parameter.md | 8 +- ...3-17-clop_ransomware_known_service_name.md | 8 +- ...021-03-23-certutil_with_decode_argument.md | 8 +- ...021-03-29-powershell_start-bitstransfer.md | 8 +- ...03-31-aws_iam_successful_group_deletion.md | 8 +- ...021-03-31-disabling_firewall_with_netsh.md | 10 +- .../2021-03-31-dsquery_domain_discovery.md | 8 +- ...-aws_iam_assume_role_policy_brute_force.md | 8 +- .../2021-04-01-aws_iam_delete_policy.md | 8 +- ...21-04-01-aws_iam_failure_group_deletion.md | 8 +- ...icious_powershell_executed_as_a_service.md | 8 +- ...o_authenticate_from_host_using_kerberos.md | 8 +- ...heduled_task_created_within_public_path.md | 10 +- .../2021-04-12-excel_spawning_powershell.md | 8 +- ...4-12-excel_spawning_windows_script_host.md | 8 +- ...t_scheduled_task_created_to_spawn_shell.md | 10 +- .../2021-04-12-winword_spawning_powershell.md | 8 +- ...12-winword_spawning_windows_script_host.md | 8 +- ...1-04-13-aws_excessive_security_scanning.md | 8 +- ...ng_to_authenticate_from_host_using_ntlm.md | 8 +- ...rs_failing_to_authenticate_from_process.md | 8 +- ...otely_failing_to_authenticate_from_host.md | 8 +- ...fice_application_spawn_rundll32_process.md | 12 +- ...authenticate_using_explicit_credentials.md | 8 +- ...-office_document_creating_schedule_task.md | 8 +- ...14-office_document_executing_macro_code.md | 8 +- ..._users_failing_to_authenticate_kerberos.md | 8 +- ...sers_failed_authentication_via_kerberos.md | 8 +- ...-15-dns_exfiltration_using_nslookup_app.md | 8 +- ...ng_to_authenticate_from_host_using_ntlm.md | 8 +- ..._remote_thread_to_known_windows_process.md | 8 +- ...hedule_task_with_http_command_arguments.md | 10 +- ...dule_task_with_rundll32_command_trigger.md | 10 +- ...ess_connecting_to_ip_check_web_services.md | 8 +- ...9-wermgr_process_create_executable_file.md | 8 +- ...ocess_spawned_cmd_or_powershell_process.md | 12 +- ...1-04-21-excessive_usage_of_nslookup_app.md | 8 +- ...ultiple_archive_files_http_post_traffic.md | 16 +- .../2021-04-22-anomalous_usage_of_7zip.md | 8 +- ...e_product_spawning_rundll32_with_no_dll.md | 12 +- ...-04-22-plain_http_post_exfiltrated_data.md | 16 +- .../_posts/2021-04-22-winword_spawning_cmd.md | 10 +- ...04-26-office_product_spawning_bitsadmin.md | 12 +- ...-04-26-office_product_spawning_certutil.md | 8 +- ...021-04-26-office_product_spawning_mshta.md | 10 +- docs/_posts/2021-04-26-trickbot_named_pipe.md | 8 +- docs/_posts/2021-04-29-icacls_deny_command.md | 8 +- ...021-04-29-suspicious_driver_loaded_path.md | 8 +- docs/_posts/2021-04-29-xmrig_driver_loaded.md | 8 +- .../2021-05-04-deleting_of_net_users.md | 10 +- .../2021-05-04-disabling_net_user_account.md | 10 +- ...4-excessive_attempt_to_disable_services.md | 8 +- ...21-05-04-excessive_service_stop_attempt.md | 10 +- .../2021-05-04-excessive_usage_of_taskkill.md | 8 +- .../_posts/2021-05-04-icacls_grant_command.md | 8 +- ...21-05-04-process_kill_base_on_file_path.md | 8 +- ...2021-05-05-suspicious_process_file_path.md | 8 +- ...021-05-06-download_files_using_telegram.md | 8 +- ...merate_users_local_group_using_telegram.md | 10 +- .../2021-05-06-excessive_usage_of_net_app.md | 10 +- ...s_or_script_creation_in_suspicious_path.md | 8 +- ...2021-05-07-excessive_usage_of_cacls_app.md | 8 +- .../2021-05-07-schtasks_run_task_on_demand.md | 8 +- ...05-12-delete_shadowcopy_with_powershell.md | 8 +- ...2021-05-13-cmlua_or_cmstplua_uac_bypass.md | 14 +- docs/_posts/2021-05-13-slui_runas_elevated.md | 8 +- .../2021-05-13-slui_spawning_a_process.md | 8 +- .../2021-05-18-services_escalate_exe.md | 8 +- ...-allow_inbound_traffic_in_firewall_rule.md | 8 +- .../2021-05-19-mailsniper_invoke_functions.md | 8 +- .../2021-05-20-cmd_echo_pipe_-_escalation.md | 10 +- .../2021-05-21-winrm_spawning_a_process.md | 10 +- ...6-secretdumps_offline_ntds_dumping_tool.md | 8 +- ...27-detect_sharphound_file_modifications.md | 8 +- .../2021-05-27-detect_sharphound_usage.md | 8 +- ...etect_azurehound_command-line_arguments.md | 8 +- ...01-detect_azurehound_file_modifications.md | 8 +- ...etect_sharphound_command-line_arguments.md | 8 +- .../2021-06-02-conti_common_exec_parameter.md | 8 +- .../2021-06-02-modification_of_wallpaper.md | 8 +- .../2021-06-02-revil_common_exec_parameter.md | 8 +- ...021-06-02-wbemprox_com_object_execution.md | 14 +- ...-04-known_services_killed_by_ransomware.md | 8 +- ...-excessive_number_of_taskhost_processes.md | 8 +- ...ss_process_injection_via_getprocaddress.md | 8 +- ..._script_contains_base64_encoded_content.md | 8 +- ...re_with_powershell_script_block_logging.md | 8 +- ...tz_with_powershell_script_block_logging.md | 8 +- ...021-06-09-unloading_amsi_via_reflection.md | 8 +- ...ear_unallocated_sector_using_cipher_app.md | 8 +- .../2021-06-10-disable_logs_using_wevtutil.md | 8 +- ...rmission_modification_using_takeown_app.md | 8 +- ...-06-10-powershell_creating_thread_mutex.md | 8 +- ...021-06-10-powershell_domain_enumeration.md | 8 +- ...ading_dotnet_into_memory_via_reflection.md | 8 +- ...10-powershell_processing_stream_of_data.md | 8 +- ...ent_automatic_repair_mode_using_bcdedit.md | 8 +- .../2021-06-10-recon_using_wmi_class.md | 8 +- ...4-wmi_recon_running_process_or_services.md | 8 +- ...tect_wmi_event_subscription_persistence.md | 8 +- ...7-suspicious_event_log_service_behavior.md | 10 +- ...ecute_javascript_with_jscript_com_clsid.md | 8 +- ...-powershell_enable_smb1protocol_feature.md | 8 +- ...ursive_delete_of_directory_in_batch_cmd.md | 10 +- ...w_file_and_printing_sharing_in_firewall.md | 10 +- ...-23-allow_network_discovery_in_firewall.md | 10 +- ...4-excessive_usage_of_sc_service_utility.md | 8 +- ...er_of_service_control_start_as_disabled.md | 8 +- ...1-print_spooler_adding_a_printer_driver.md | 8 +- ...-print_spooler_failed_to_load_a_plug-in.md | 8 +- .../2021-07-01-spoolsv_spawning_rundll32.md | 12 +- ...07-01-spoolsv_suspicious_loaded_modules.md | 8 +- ...07-01-spoolsv_suspicious_process_access.md | 8 +- .../2021-07-01-spoolsv_writing_a_dll.md | 8 +- ...21-07-01-spoolsv_writing_a_dll_-_sysmon.md | 8 +- ...05-msmpeng_application_dll_side_loading.md | 8 +- ...-powershell_disable_security_monitoring.md | 8 +- ...-07-12-uac_bypass_mmc_load_unsigned_dll.md | 8 +- ...tance_created_by_previously_unseen_user.md | 8 +- .../2021-07-19-aws_createloginprofile.md | 8 +- .../2021-07-19-detect_new_open_s3_buckets.md | 8 +- ...detect_new_open_s3_buckets_over_aws_cli.md | 8 +- ...a_spawning_rundll32_or_regsvr32_process.md | 20 +- ...-07-19-office_product_spawn_cmd_process.md | 16 +- .../2021-07-20-detect_shared_ec2_snapshot.md | 8 +- ...of_shadowcopy_with_script_block_logging.md | 8 +- ...-07-23-sam_database_file_access_attempt.md | 8 +- ...-rundll32_createremotethread_in_browser.md | 8 +- ...rundll32_process_creating_exe_dll_files.md | 14 +- ...7-26-suspicious_icedid_rundll32_cmdline.md | 18 +- ...21-07-26-suspicious_rundll32_plugininit.md | 18 +- .../2021-07-27-chcp_command_execution.md | 8 +- ...gsvr32_with_known_silent_switch_cmdline.md | 14 +- ...dll32_create_remote_thread_to_a_process.md | 8 +- .../2021-07-30-drop_icedid_license_dat.md | 8 +- ...edid_exfiltrated_archived_file_creation.md | 8 +- ...fice_application_spawn_regsvr32_process.md | 8 +- ...2021-08-03-sqlite_module_in_temp_folder.md | 8 +- ...eate_remote_thread_in_shell_application.md | 8 +- .../2021-08-09-uninstall_app_using_msiexec.md | 14 +- docs/_posts/2021-08-11-fsutil_zeroing_file.md | 8 +- ...8-13-uac_bypass_with_colorui_com_object.md | 14 +- ...16-gsuite_drive_share_in_external_email.md | 8 +- ...8-16-gsuite_email_suspicious_attachment.md | 10 +- ...8-17-7zip_commandline_to_smb_share_path.md | 8 +- ...ws_ecr_container_scanning_findings_high.md | 8 +- ...ning_findings_low_informational_unknown.md | 8 +- ..._ecr_container_scanning_findings_medium.md | 8 +- ...mail_with_attachment_to_external_domain.md | 16 +- docs/_posts/2021-08-18-esentutl_sam_copy.md | 8 +- .../2021-08-18-powershell_4104_hunting.md | 8 +- ...container_upload_outside_business_hours.md | 8 +- ...9-aws_ecr_container_upload_unknown_user.md | 12 +- ...mail_suspicious_subject_with_attachment.md | 10 +- ...ols_passing_authentication_in_cleartext.md | 10 +- ...1-08-20-github_commit_changes_in_master.md | 8 +- ...2021-08-20-kubernetes_nginx_ingress_lfi.md | 8 +- ...2021-08-23-getlocaluser_with_powershell.md | 8 +- ...twmiobject_user_account_with_powershell.md | 8 +- ...er_account_with_powershell_script_block.md | 8 +- ...email_with_known_abuse_web_service_link.md | 10 +- ...8-23-gsuite_suspicious_shared_file_name.md | 8 +- ...2021-08-23-kubernetes_nginx_ingress_rfi.md | 8 +- ...21-08-24-adsisearcher_account_discovery.md | 8 +- ...4-domain_account_discovery_with_dsquery.md | 8 +- ...4-domain_account_discovery_with_net_app.md | 10 +- ...8-24-domain_account_discovery_with_wmic.md | 8 +- ...1-08-24-get-domaintrust_with_powershell.md | 8 +- ...omaintrust_with_powershell_script_block.md | 8 +- .../2021-08-24-get_aduser_with_powershell.md | 8 +- ...get_aduser_with_powershell_script_block.md | 8 +- ...21-08-24-get_domainuser_with_powershell.md | 8 +- ...24-getwmiobject_ds_user_with_powershell.md | 8 +- ...ct_ds_user_with_powershell_script_block.md | 8 +- ...-08-24-kubernetes_scanner_image_pulling.md | 10 +- ...omain_group_discovery_with_adsisearcher.md | 8 +- ...1-08-25-domain_group_discovery_with_net.md | 8 +- ...-08-25-domain_group_discovery_with_wmic.md | 8 +- ...08-25-elevated_group_discovery_with_net.md | 8 +- ...elevated_group_discovery_with_powerview.md | 8 +- ...8-25-elevated_group_discovery_with_wmic.md | 8 +- .../2021-08-25-getadgroup_with_powershell.md | 8 +- ...21-08-25-getdomaingroup_with_powershell.md | 8 +- ...-25-getnettcpconnection_with_powershell.md | 8 +- ...5-getwmiobject_ds_group_with_powershell.md | 8 +- ...t_ds_group_with_powershell_script_block.md | 8 +- ...ultdomainpasswordpolicy_with_powershell.md | 8 +- ...resultantpasswordpolicy_with_powershell.md | 8 +- ...wordpolicy_with_powershell_script_block.md | 8 +- ...-08-26-get_domainpolicy_with_powershell.md | 8 +- ...mainpolicy_with_powershell_script_block.md | 8 +- ...omaingroup_with_powershell_script_block.md | 8 +- ...8-26-password_policy_discovery_with_net.md | 8 +- ...reating_lnk_file_in_suspicious_location.md | 8 +- ...8-27-exchange_powershell_abuse_via_ssrf.md | 10 +- ...-08-27-exchange_powershell_module_usage.md | 10 +- ...domain_controller_discovery_with_nltest.md | 8 +- ...-08-30-remote_system_discovery_with_net.md | 8 +- ...petitpotam_network_share_access_request.md | 10 +- ...itpotam_suspicious_kerberos_tgt_request.md | 10 +- ...31-remote_system_discovery_with_dsquery.md | 8 +- ...1-09-01-circle_ci_disable_security_step.md | 10 +- ...1-domain_controller_discovery_with_wmic.md | 8 +- ...-01-domain_group_discovery_with_dsquery.md | 8 +- ...adcomputer_with_powershell_script_block.md | 8 +- ...s_computer_with_powershell_script_block.md | 8 +- .../2021-09-01-github_commit_in_develop.md | 8 +- .../2021-09-01-github_dependabot_alert.md | 8 +- ...1-github_pull_request_from_unknown_user.md | 10 +- ...mote_system_discovery_with_adsisearcher.md | 8 +- ...09-01-remote_system_discovery_with_wmic.md | 8 +- ...21-09-02-circle_ci_disable_security_job.md | 10 +- ...1-09-02-get-foresttrust_with_powershell.md | 8 +- ...oresttrust_with_powershell_script_block.md | 8 +- ...incomputer_with_powershell_script_block.md | 8 +- ...controller_with_powershell_script_block.md | 8 +- ...cdedit_command_back_to_normal_mode_boot.md | 8 +- ...change_to_safe_mode_with_network_config.md | 8 +- ...9-06-correlation_by_repository_and_risk.md | 8 +- ...2021-09-06-correlation_by_user_and_risk.md | 8 +- ...021-09-07-getadcomputer_with_powershell.md | 8 +- ...09-07-getdomaincomputer_with_powershell.md | 8 +- ...-07-getdomaincontroller_with_powershell.md | 8 +- ...etwmiobject_ds_computer_with_powershell.md | 8 +- ...e_by_app_connect_and_create_adsi_object.md | 8 +- ...-system_information_discovery_detection.md | 8 +- ...l_loading_from_world_writable_directory.md | 14 +- ...eate_local_admin_accounts_using_net_exe.md | 8 +- .../2021-09-08-office_spawning_control.md | 8 +- ...2021-09-08-rundll32_control_rundll_hunt.md | 18 +- ...control_rundll_world_writable_directory.md | 18 +- ...2021-09-09-extraction_of_registry_hives.md | 8 +- ...09-mshtml_module_load_in_office_product.md | 8 +- ...connection_with_powershell_script_block.md | 8 +- ...0-network_connection_discovery_with_arp.md | 8 +- ...0-network_connection_discovery_with_net.md | 8 +- ...twork_connection_discovery_with_netstat.md | 8 +- ...09-10-office_product_writing_cab_or_inf.md | 8 +- ...1-09-13-getcurrent_user_with_powershell.md | 8 +- ...-13-jscript_execution_using_cscript_app.md | 8 +- ...s_scripting_process_loading_ldap_module.md | 8 +- ...ms_scripting_process_loading_wmi_module.md | 8 +- ...9-13-office_application_drop_executable.md | 8 +- ...-09-13-system_user_discovery_with_query.md | 8 +- ...09-13-system_user_discovery_with_whoami.md | 8 +- ...user_discovery_with_env_vars_powershell.md | 8 +- ...21-09-13-xsl_script_execution_with_wmic.md | 8 +- ...-cmdline_tool_not_executed_in_cmd_shell.md | 8 +- ...021-09-14-get_wmiobject_group_discovery.md | 8 +- .../2021-09-14-net_localgroup_discovery.md | 8 +- ...-14-powershell_get_localgroup_discovery.md | 8 +- ...oup_discovery_with_script_block_logging.md | 8 +- .../_posts/2021-09-14-wmic_group_discovery.md | 8 +- ...1-09-15-check_elevated_cmd_using_whoami.md | 8 +- ...me_process_accessing_chrome_default_dir.md | 10 +- ...efox_process_access_firefox_profile_dir.md | 10 +- ...21-09-16-account_discovery_with_net_app.md | 10 +- ...t_to_add_certificate_to_untrusted_store.md | 8 +- ...edential_dump_from_registry_via_reg_exe.md | 10 +- ...2021-09-16-batch_file_write_to_system32.md | 8 +- .../_posts/2021-09-16-bits_job_persistence.md | 12 +- .../2021-09-16-bitsadmin_download_file.md | 12 +- ...of_shadow_copy_with_wmic_and_powershell.md | 8 +- ...mping_via_copy_command_from_shadow_copy.md | 10 +- ...tial_dumping_via_symlink_to_shadow_copy.md | 10 +- ...16-detect_html_help_url_in_command_line.md | 16 +- ...ml_help_using_infotech_storage_handlers.md | 16 +- ...09-16-detect_mshta_inline_hta_execution.md | 16 +- ...-09-16-detect_mshta_url_in_command_line.md | 16 +- ...9-16-detect_psexec_with_accepteula_flag.md | 10 +- .../_posts/2021-09-16-detect_renamed_7-zip.md | 8 +- .../2021-09-16-detect_renamed_rclone.md | 8 +- .../2021-09-16-detect_renamed_winrar.md | 8 +- .../2021-09-16-dump_lsass_via_procdump.md | 10 +- ...-09-16-local_account_discovery_with_net.md | 10 +- ...09-16-local_account_discovery_with_wmic.md | 8 +- ...2021-09-16-office_product_spawning_wmic.md | 8 +- .../2021-09-16-processes_launching_netsh.md | 10 +- ...ument_spawned_child_process_to_download.md | 8 +- ...mcos_rat_file_creation_in_remcos_folder.md | 8 +- ...icious_image_creation_in_appdata_folder.md | 8 +- ...1-suspicious_wav_file_in_appdata_folder.md | 8 +- ...1-09-27-change_default_file_association.md | 8 +- ...27-logon_script_event_trigger_execution.md | 8 +- ...-27-screensaver_event_trigger_execution.md | 8 +- ...9-28-print_processor_registry_autostart.md | 10 +- .../2021-09-29-verclsid_clsid_execution.md | 14 +- ...01-vbscript_execution_using_wscript_app.md | 8 +- ...ld_suspicious_spawned_by_script_process.md | 12 +- ...32_silent_and_install_param_dll_loading.md | 14 +- .../2021-10-05-detect_exchange_web_shell.md | 8 +- ...5-malicious_inprocserver32_modification.md | 8 +- ...1-10-05-process_writing_dynamicwrapperx.md | 8 +- .../2021-10-05-rundll32_shimcache_flush.md | 12 +- .../2021-10-05-suspicious_copy_on_system32.md | 10 +- .../2021-10-05-winhlp32_spawning_a_process.md | 8 +- ...ery_length_with_high_standard_deviation.md | 14 +- ...021-10-06-sdelete_application_execution.md | 10 +- ...ipt_or_cscript_suspicious_child_process.md | 8 +- .../2021-10-11-suspicious_wevtutil_usage.md | 8 +- ...rincipalnames_discovery_with_powershell.md | 8 +- ...iceprincipalnames_discovery_with_setspn.md | 8 +- .../2021-10-18-disable_schedule_task.md | 8 +- ...indows_curl_download_to_suspicious_path.md | 10 +- ...ows_task_scheduler_event_action_started.md | 8 +- ...-wmic_noninteractive_app_uninstallation.md | 8 +- ...21-10-24-gdrive_suspicious_file_sharing.md | 10 +- ...10-24-gsuite_suspicious_calendar_invite.md | 10 +- docs/_posts/2021-11-03-windows_adfind_exe.md | 8 +- .../2021-11-04-attacker_tools_on_endpoint.md | 8 +- ...ndows_curl_upload_to_remote_destination.md | 10 +- ...ows_service_creation_on_remote_endpoint.md | 8 +- ...s_service_initiation_on_remote_endpoint.md | 8 +- ...ocess_instantiation_via_winrm_and_winrs.md | 8 +- ...sk_creation_on_remote_endpoint_using_at.md | 14 +- ...uled_task_initiation_on_remote_endpoint.md | 8 +- .../2021-11-11-wmic_xsl_execution_via_url.md | 8 +- ...2-aws_iam_accessdenied_discovery_events.md | 8 +- ...21-11-12-csc_net_on_the_fly_compilation.md | 10 +- ...1-11-12-firewall_allowed_program_enable.md | 8 +- ...twork_discovery_using_route_windows_app.md | 8 +- ...12-remote_process_instantiation_via_wmi.md | 8 +- ...21-11-12-runas_execution_in_commandline.md | 10 +- ...12-windows_installutil_credential_theft.md | 14 +- ...12-windows_installutil_uninstall_option.md | 18 +- ...windows_installutil_url_in_command_line.md | 18 +- ...s_instantiation_via_dcom_and_powershell.md | 8 +- ...ss_instantiation_via_wmi_and_powershell.md | 8 +- ...ion_via_wmi_and_powershell_script_block.md | 8 +- .../2021-11-15-windows_diskcryptor_usage.md | 8 +- ...requency_copy_of_files_in_network_share.md | 8 +- ..._instantiation_via_winrm_and_powershell.md | 8 +- ...2021-11-17-windows_dism_remove_defender.md | 8 +- ...ile_written_in_administrative_smb_share.md | 10 +- .../2021-11-18-loading_of_dynwrapx_module.md | 8 +- ...info_gathering_using_dxdiag_application.md | 8 +- ...22-possible_browser_pass_view_parameter.md | 8 +- ...services_lolbas_execution_process_spawn.md | 8 +- ...-svchost_lolbas_execution_process_spawn.md | 8 +- ...ce_created_with_suspicious_service_path.md | 8 +- ...dows_service_created_within_public_path.md | 8 +- ...wmiprsve_lolbas_execution_process_spawn.md | 8 +- ...provhost_lolbas_execution_process_spawn.md | 8 +- ...1-23-mmc_lolbas_execution_process_spawn.md | 8 +- ...5-add_or_set_windows_defender_exclusion.md | 8 +- ...ell_windows_defender_exclusion_commands.md | 8 +- ...ndows_defender_exclusion_registry_entry.md | 8 +- ...-11-29-detect_rclone_command-line_usage.md | 10 +- ...sible_lateral_movement_powershell_spawn.md | 8 +- ...-randomly_generated_scheduled_task_name.md | 10 +- ...randomly_generated_windows_service_name.md | 10 +- ...r_of_computer_service_tickets_requested.md | 10 +- ...f_remote_endpoint_authentication_events.md | 10 +- .../2021-12-03-short_lived_scheduled_task.md | 8 +- ...-06-suspicious_linux_discovery_commands.md | 8 +- ...ion_service_writing_active_server_pages.md | 10 +- ...windows_raccine_scheduled_task_deletion.md | 8 +- ...-msi_module_loaded_by_non-system_binary.md | 8 +- ...-12-10-curl_download_and_bash_execution.md | 8 +- ...-12-11-wget_download_and_bash_execution.md | 8 +- ...2021-12-13-detect_outbound_ldap_traffic.md | 8 +- ..._class_file_download_by_java_user_agent.md | 8 +- .../2021-12-13-linux_java_spawning_shell.md | 10 +- ...og4shell_jndi_payload_injection_attempt.md | 8 +- ...load_injection_with_outbound_connection.md | 8 +- ...onnection_from_java_using_default_ports.md | 8 +- ...2021-12-13-windows_java_spawning_shells.md | 12 +- .../2021-12-14-hunting_for_log4shell.md | 8 +- ..._add_files_in_known_crontab_directories.md | 8 +- ...-17-linux_at_allow_config_file_creation.md | 8 +- ...1-12-17-linux_edit_cron_table_parameter.md | 8 +- ..._cronjob_entry_on_existing_cronjob_file.md | 8 +- ...ssible_cronjob_modification_with_editor.md | 8 +- ...ux_file_creation_in_init_boot_directory.md | 8 +- ...inux_file_creation_in_profile_directory.md | 8 +- ...e_append_command_to_profile_config_file.md | 8 +- ...rvice_file_created_in_systemd_directory.md | 8 +- .../2021-12-20-linux_service_restarted.md | 8 +- ...-12-20-linux_service_started_or_enabled.md | 8 +- ...suspicious_computer_account_name_change.md | 8 +- ...picious_kerberos_service_ticket_request.md | 8 +- .../2021-12-21-linux_add_user_account.md | 8 +- ...1-12-21-linux_change_file_owner_to_root.md | 8 +- ...21-linux_nopasswd_entry_in_sudoers_file.md | 8 +- ...-12-21-linux_setuid_using_chmod_utility.md | 8 +- ...12-21-linux_setuid_using_setcap_utility.md | 8 +- ...21-12-21-linux_visudo_utility_execution.md | 8 +- ...spicious_ticket_granting_ticket_request.md | 8 +- ...file_created_in_kernel_driver_directory.md | 8 +- ...sert_kernel_module_using_insmod_utility.md | 8 +- ...ll_kernel_module_using_modprobe_utility.md | 8 +- ...2-22-linux_preload_hijack_library_calls.md | 8 +- ...ux_common_process_for_elevation_control.md | 8 +- ...1-12-23-linux_sudoers_tmp_file_creation.md | 8 +- .../2022-01-04-linux_sudo_or_su_execution.md | 8 +- ...022-01-05-linux_doas_conf_file_creation.md | 8 +- .../2022-01-05-linux_doas_tool_execution.md | 8 +- ...nux_possible_access_to_credential_files.md | 8 +- ...0-linux_possible_access_to_sudoers_file.md | 8 +- ...ess_or_modification_of_sshd_config_file.md | 8 +- ...11-linux_possible_ssh_key_file_creation.md | 8 +- ..._connect_to_internet_with_hidden_window.md | 8 +- ..._hunting_system_account_targeting_lsass.md | 8 +- ...dows_non-system_account_targeting_lsass.md | 8 +- ...tentially_malicious_code_on_commandline.md | 10 +- ...-cmd_carry_out_string_command_parameter.md | 10 +- ...lateral_movement_commandline_parameters.md | 8 +- ...us_powershell_process_-_encoded_command.md | 8 +- ...shell_remove_windows_defender_directory.md | 8 +- ...cess_dns_query_known_abuse_web_services.md | 8 +- ...spicious_process_with_discord_dns_query.md | 8 +- ...dows_dotnet_binary_in_non_standard_path.md | 14 +- ...indows_installutil_in_non_standard_path.md | 18 +- ...ive_file_deletion_in_windefender_folder.md | 8 +- .../2022-01-20-ping_sleep_batch_command.md | 10 +- .../2022-01-21-windows_nirsoft_advancedrun.md | 8 +- .../2022-01-24-windows_nirsoft_utilities.md | 10 +- ...2-01-26-active_setup_registry_autostart.md | 8 +- ...dd_defaultuser_and_password_in_registry.md | 8 +- ...bound_traffic_by_firewall_rule_registry.md | 8 +- ...1-26-allow_operation_with_consent_admin.md | 8 +- ...022-01-26-disable_amsi_through_registry.md | 8 +- ...-26-disable_defender_antivirus_registry.md | 8 +- ...sable_defender_blockatfirstseen_feature.md | 8 +- ...-disable_defender_enhanced_notification.md | 8 +- ...1-26-disable_defender_mpengine_registry.md | 8 +- ...01-26-disable_defender_spynet_reporting.md | 8 +- ...defender_submit_samples_consent_feature.md | 8 +- ...6-log4shell_cve-2021-44228_exploitation.md | 8 +- ...1-26-registry_keys_used_for_persistence.md | 8 +- ...stry_keys_used_for_privilege_escalation.md | 8 +- ...26-remcos_client_registry_install_entry.md | 8 +- ...1-26-time_provider_persistence_registry.md | 8 +- ...2022-01-27-disable_etw_through_registry.md | 8 +- .../2022-01-27-disable_registry_tool.md | 8 +- ...ble_security_logs_using_minint_registry.md | 8 +- .../2022-01-27-disable_show_hidden_files.md | 8 +- ...22-01-27-disable_uac_remote_restriction.md | 8 +- .../2022-01-27-disable_windows_app_hotkeys.md | 8 +- ...-27-disable_windows_behavior_monitoring.md | 8 +- ...-disable_windows_smartscreen_protection.md | 8 +- .../2022-01-27-disabling_cmd_application.md | 8 +- .../2022-01-27-disabling_controlpanel.md | 8 +- ...-27-windows_possible_credential_dumping.md | 8 +- .../2022-01-28-disabling_defender_services.md | 8 +- ...disabling_folderoptions_windows_feature.md | 8 +- .../2022-01-28-disabling_norun_windows_app.md | 8 +- ...-28-disabling_systemrestore_in_registry.md | 8 +- .../2022-01-28-disabling_task_manager.md | 8 +- ...2-01-28-enable_rdp_in_other_port_number.md | 8 +- ...ble_wdigest_uselogoncredential_registry.md | 8 +- .../2022-01-28-etw_registry_disabled.md | 8 +- docs/_posts/2022-01-28-eventvwr_uac_bypass.md | 8 +- ...8-hide_user_account_from_sign-in_screen.md | 8 +- ...01-28-linux_pkexec_privilege_escalation.md | 8 +- ...tz_passtheticket_commandline_parameters.md | 8 +- ...22-02-01-rubeus_command_line_parameters.md | 8 +- ...nload_with_urlcache_and_split_arguments.md | 8 +- ...load_with_verifyctl_and_split_arguments.md | 8 +- ...2022-02-03-o365_added_service_principal.md | 8 +- ...22-02-03-o365_bypass_mfa_via_trusted_ip.md | 8 +- docs/_posts/2022-02-03-o365_disable_mfa.md | 8 +- ..._ticket_exports_through_winlogon_access.md | 8 +- ...dows_remote_assistance_spawning_process.md | 10 +- ...7-windows_schtasks_create_run_as_system.md | 8 +- ...022-02-08-rundll_loading_dll_by_ordinal.md | 18 +- ...r_of_kerberos_service_tickets_requested.md | 8 +- ...oasting_spn_request_with_rc4_encryption.md | 10 +- ...22-02-11-linux_system_network_discovery.md | 8 +- .../2022-02-14-linux_dd_file_overwrite.md | 8 +- .../2022-02-15-detection_of_dns_tunnels.md | 14 +- ...2-15-windows_diskshadow_proxy_execution.md | 16 +- ...22-02-15-windows_rasautou_dll_execution.md | 14 +- ...-17-windows_disable_notification_center.md | 8 +- ..._raw_access_to_master_boot_record_drive.md | 8 +- ...8-detect_regasm_with_network_connection.md | 14 +- ...-detect_regsvcs_with_network_connection.md | 14 +- ...authentication_discovery_with_powerview.md | 8 +- .../2022-02-18-net_profiler_uac_bypass.md | 8 +- ...excessive_authentication_failures_alert.md | 8 +- ...-process_deleting_its_process_file_path.md | 8 +- docs/_posts/2022-02-18-rundll32_dnsquery.md | 14 +- ...cution_policy_to_unrestricted_or_bypass.md | 8 +- ...uthentication_discovery_with_get-aduser.md | 8 +- ...ion_flag_disabled_in_useraccountcontrol.md | 8 +- ...heduled_task_deleted_or_created_via_cmd.md | 8 +- ...2-02-22-windows_wmi_process_call_create.md | 8 +- ...ndows_excessive_disabled_services_event.md | 8 +- ...dows_process_with_namedpipe_commandline.md | 8 +- ...s_service_creation_using_registry_entry.md | 8 +- ...022-02-24-aws_lambda_updatefunctioncode.md | 8 +- ...02-25-windows_disable_memory_crash_dump.md | 8 +- ...le_without_extension_in_critical_folder.md | 8 +- ...ows_raw_access_to_disk_volume_partition.md | 8 +- ...ve_distinct_processes_from_windows_temp.md | 8 +- ...ow_compress_color_and_info_tip_registry.md | 8 +- docs/_posts/2022-03-03-aws_createaccesskey.md | 8 +- .../2022-03-03-aws_updateloginprofile.md | 8 +- ...rberos_tgt_request_using_rc4_encryption.md | 8 +- docs/_posts/2022-03-04-macos_lolbin.md | 8 +- .../2022-03-08-suspicious_msbuild_path.md | 12 +- ...isable_change_password_through_registry.md | 8 +- ...ck_workstation_feature_through_registry.md | 8 +- ..._disable_logoff_button_through_registry.md | 8 +- ...isable_shutdown_button_through_registry.md | 8 +- ..._group_policy_features_through_registry.md | 8 +- ..._notification_features_through_registry.md | 8 +- ...own_process_using_the_kerberos_protocol.md | 8 +- .../2022-03-10-kerberos_user_enumeration.md | 8 +- ...t_regasm_with_no_command_line_arguments.md | 16 +- ..._regsvcs_with_no_command_line_arguments.md | 16 +- ..._no_command_line_arguments_with_network.md | 8 +- ..._no_command_line_arguments_with_network.md | 8 +- ...ice_ticket_request_using_rc4_encryption.md | 10 +- ..._no_command_line_arguments_with_network.md | 18 +- ...lhost_with_no_command_line_with_network.md | 8 +- ...cious_dllhost_no_command_line_arguments.md | 8 +- ...ious_gpupdate_no_command_line_arguments.md | 12 +- ...ious_rundll32_no_command_line_arguments.md | 18 +- ...hprotocolhost_no_command_line_arguments.md | 8 +- ...s_installutil_remote_network_connection.md | 18 +- ...stallutil_uninstall_option_with_network.md | 18 +- ...odify_acl_permission_to_files_or_folder.md | 8 +- ...wordpolicy_with_powershell_script_block.md | 8 +- ...domainuser_with_powershell_script_block.md | 8 +- ...oup_discovery_with_script_block_logging.md | 8 +- ...getadgroup_with_powershell_script_block.md | 8 +- ...rrent_user_with_powershell_script_block.md | 8 +- ...tlocaluser_with_powershell_script_block.md | 8 +- ...sion_on_remote_endpoint_with_powershell.md | 8 +- ...ntication_flag_disabled_with_powershell.md | 8 +- ...022-03-22-powershell_execute_com_object.md | 8 +- ...owershell_using_memory_as_backing_store.md | 8 +- ...3-22-recon_avproduct_through_pwh_or_wmi.md | 8 +- ...on_via_dcom_and_powershell_script_block.md | 8 +- ...n_via_winrm_and_powershell_script_block.md | 8 +- ...y_with_env_vars_powershell_script_block.md | 8 +- ...24-splunk_dos_via_malformed_s2s_request.md | 8 +- ...2022-03-28-sql_injection_with_long_urls.md | 10 +- ...try_by_a_non_critical_process_file_path.md | 8 +- ...uter_unconstrained_delegation_discovery.md | 8 +- ...view_unconstrained_delegation_discovery.md | 8 +- ...03-28-windows_terminating_lsass_process.md | 8 +- ...022-03-29-windows_iso_lnk_file_creation.md | 8 +- ...-30-windows_drivers_loaded_by_signature.md | 8 +- ...erview_constrained_delegation_discovery.md | 8 +- ...3-31-windows_registry_certificate_added.md | 8 +- ..._modification_for_safe_mode_persistence.md | 8 +- ...ithub_actions_disable_security_workflow.md | 8 +- ...4-windows_driver_load_non-standard_path.md | 8 +- ...4-04-windows_event_for_service_disabled.md | 8 +- .../2022-04-05-java_writing_jsp_file.md | 8 +- ...nux_stdout_redirection_to_dev_null_file.md | 10 +- ...-04-05-spring4shell_payload_url_request.md | 8 +- .../2022-04-05-web_jsp_request_via_url.md | 8 +- ...eb_spring_cloud_function_functionrouter.md | 8 +- ...indirect_command_execution_via_forfiles.md | 8 +- ...s_indirect_command_execution_via_pcalua.md | 8 +- ..._spring4shell_http_request_class_module.md | 10 +- .../2022-04-07-any_powershell_downloadfile.md | 8 +- ...022-04-07-any_powershell_downloadstring.md | 8 +- .../2022-04-07-detect_html_help_renamed.md | 14 +- .../_posts/2022-04-07-detect_mshta_renamed.md | 14 +- .../2022-04-07-detect_renamed_psexec.md | 8 +- ...ious_microsoft_workflow_compiler_rename.md | 8 +- .../2022-04-07-suspicious_msbuild_rename.md | 8 +- .../2022-04-07-suspicious_rundll32_rename.md | 14 +- ...unt_manipulation_of_ssh_config_and_keys.md | 8 +- .../2022-04-12-linux_deletion_of_cron_jobs.md | 8 +- ...12-linux_deletion_of_init_daemon_script.md | 8 +- .../2022-04-12-linux_deletion_of_services.md | 8 +- ...04-12-linux_deletion_of_ssl_certificate.md | 8 +- ...requency_of_file_deletion_in_etc_folder.md | 8 +- ...2-04-13-windows_registry_delete_task_sd.md | 8 +- ...022-04-18-nltest_domain_trust_discovery.md | 12 +- ...nux_adding_crontab_using_list_parameter.md | 8 +- ...ing_critical_directory_using_rm_command.md | 8 +- .../2022-04-22-linux_disable_services.md | 8 +- ...equency_of_file_deletion_in_boot_folder.md | 8 +- ...022-04-22-linux_shred_overwrite_command.md | 8 +- docs/_posts/2022-04-22-linux_stop_services.md | 8 +- ...rocesses_killed_by_industroyer2_malware.md | 8 +- ...ndows_linked_policies_in_adsi_discovery.md | 8 +- ...s_root_domain_linked_policies_discovery.md | 8 +- ...6-windows_hidden_schedule_task_settings.md | 10 +- ...-04-27-splunk_xss_in_monitoring_console.md | 8 +- ...ter_account_created_by_computer_account.md | 10 +- ...uter_account_requesting_kerberos_ticket.md | 10 +- ...windows_kerberos_local_successful_logon.md | 10 +- ...04-28-windows_computer_account_with_spn.md | 10 +- ...2022-04-29-path_traversal_spl_injection.md | 10 +- ...2-04-29-splunk_user_enumeration_attempt.md | 8 +- ...30-linux_iptables_firewall_modification.md | 8 +- ...worker_process_in_writable_process_path.md | 8 +- ...-02-windows_krbrelayup_service_creation.md | 8 +- ...ndows_service_create_kernel_mode_driver.md | 8 +- ...10-detect_aws_console_login_by_new_user.md | 8 +- ...ontrol_rest_vulnerability_cve-2022-1388.md | 8 +- .../2022-05-16-cobalt_strike_named_pipes.md | 8 +- .../2022-05-16-windows_system_file_on_disk.md | 8 +- ...e_policy_version_to_allow_all_resources.md | 8 +- ...are_server_side_template_injection_hunt.md | 8 +- ...eemarker_server-side_template_injection.md | 8 +- ...chtasks_scheduling_job_on_remote_system.md | 8 +- ...22-05-26-linux_at_application_execution.md | 176 ++++++++++++++++++ ..._append_command_to_at_allow_config_file.md | 176 ++++++++++++++++++ docs/_posts/2022-05-26-macos_plutil.md | 166 +++++++++++++++++ .../active_directory_lateral_movement.md | 2 +- docs/_stories/cobalt_strike.md | 8 +- docs/_stories/command_and_control.md | 14 +- docs/_stories/darkside_ransomware.md | 2 +- docs/_stories/data_destruction.md | 2 +- docs/_stories/data_exfiltration.md | 4 +- docs/_stories/data_protection.md | 2 +- docs/_stories/dev_sec_ops.md | 2 +- docs/_stories/dns_hijacking.md | 2 +- docs/_stories/hermetic_wiper.md | 2 +- docs/_stories/hidden_cobra_malware.md | 2 +- docs/_stories/host_redirection.md | 2 +- docs/_stories/icedid.md | 12 +- docs/_stories/insider_threat.md | 2 +- docs/_stories/linux_persistence_techniques.md | 4 +- docs/_stories/linux_privilege_escalation.md | 4 +- docs/_stories/living_off_the_land.md | 80 ++++---- .../masquerading_-_rename_system_utilities.md | 6 +- ...ml_remote_code_execution_cve-2021-40444.md | 6 +- docs/_stories/nobelium_group.md | 2 +- .../_stories/printnightmare_cve-2021-34527.md | 4 +- ...ed_traffic_allowed_or_protocol_mismatch.md | 2 +- docs/_stories/ransomware.md | 12 +- docs/_stories/remcos.md | 4 +- docs/_stories/revil_ransomware.md | 2 +- ...gned_binary_proxy_execution_installutil.md | 14 +- .../suspicious_compiled_html_activity.md | 8 +- docs/_stories/suspicious_dns_traffic.md | 8 +- docs/_stories/suspicious_mshta_activity.md | 12 +- .../suspicious_regsvcs_regasm_activity.md | 12 +- docs/_stories/suspicious_regsvr32_activity.md | 8 +- docs/_stories/suspicious_rundll32_activity.md | 22 +-- docs/_stories/trickbot.md | 6 +- docs/_stories/unusual_processes.md | 8 +- docs/_stories/whispergate.md | 4 +- .../windows_defense_evasion_tactics.md | 2 +- 928 files changed, 6551 insertions(+), 2485 deletions(-) create mode 100644 docs/_posts/2022-05-26-linux_at_application_execution.md create mode 100644 docs/_posts/2022-05-26-linux_possible_append_command_to_at_allow_config_file.md create mode 100644 docs/_posts/2022-05-26-macos_plutil.md diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_detections.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_detections.j2 index 60b2f1482c..b307a0c3ce 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_detections.j2 +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_detections.j2 @@ -34,7 +34,7 @@ tags: --- {% if object.experimental is sameas true -%} -### ⚠️ WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. {% endif %} @@ -134,7 +134,7 @@ We have not been able to test, simulate, or build datasets for this object. Use -#### Search +#### Search ``` {{ object.search|replace("|", "\n|")|safe }} @@ -150,7 +150,8 @@ The SPL above uses the following Macros: {% endfor %} {% endif -%} -Note that **{{object.name | lower | replace(" ", "_") }}_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **{{object.name | lower | replace(" ", "_") }}_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. {% if object.lookups -%} #### Lookups @@ -186,6 +187,9 @@ The SPL above uses the following Lookups: | {{(object.tags.impact * object.tags.confidence)/100}} | {{ object.tags.impact }} | {{ object.tags.confidence }} | {{object.tags.message}} | {% endif %} +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference {% if object.references %} {% for reference in object.references -%} diff --git a/docs/_pages/detections.md b/docs/_pages/detections.md index 62b6552f6a..44a47ad556 100644 --- a/docs/_pages/detections.md +++ b/docs/_pages/detections.md @@ -77,7 +77,7 @@ sidebar: | [CHCP Command Execution](/endpoint/chcp_command_execution/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [CMD Carry Out String Command Parameter](/endpoint/cmd_carry_out_string_command_parameter/) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [CMD Echo Pipe - Escalation](/endpoint/cmd_echo_pipe_-_escalation/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [CMLUA Or CMSTPLUA UAC Bypass](/endpoint/cmlua_or_cmstplua_uac_bypass/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [CMLUA Or CMSTPLUA UAC Bypass](/endpoint/cmlua_or_cmstplua_uac_bypass/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [CMSTP](/tags/#cmstp) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [CSC Net On The Fly Compilation](/endpoint/csc_net_on_the_fly_compilation/) | [Compile After Delivery](/tags/#compile-after-delivery), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [CertUtil Download With URLCache and Split Arguments](/endpoint/certutil_download_with_urlcache_and_split_arguments/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [CertUtil Download With VerifyCtl and Split Arguments](/endpoint/certutil_download_with_verifyctl_and_split_arguments/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -90,7 +90,7 @@ sidebar: | [Circle CI Disable Security Job](/cloud/circle_ci_disable_security_job/) | [Compromise Client Software Binary](/tags/#compromise-client-software-binary) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Circle CI Disable Security Step](/cloud/circle_ci_disable_security_step/) | [Compromise Client Software Binary](/tags/#compromise-client-software-binary) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Clear Unallocated Sector Using Cipher App](/endpoint/clear_unallocated_sector_using_cipher_app/) | [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Clients Connecting to Multiple DNS Servers](/deprecated/clients_connecting_to_multiple_dns_servers/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Clients Connecting to Multiple DNS Servers](/deprecated/clients_connecting_to_multiple_dns_servers/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Clop Common Exec Parameter](/endpoint/clop_common_exec_parameter/) | [User Execution](/tags/#user-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Clop Ransomware Known Service Name](/endpoint/clop_ransomware_known_service_name/) | [Create or Modify System Process](/tags/#create-or-modify-system-process) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Cloud API Calls From Previously Unseen User Roles](/cloud/cloud_api_calls_from_previously_unseen_user_roles/) | [Valid Accounts](/tags/#valid-accounts) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -109,7 +109,7 @@ sidebar: | [Common Ransomware Extensions](/endpoint/common_ransomware_extensions/) | [Data Destruction](/tags/#data-destruction) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Common Ransomware Notes](/endpoint/common_ransomware_notes/) | [Data Destruction](/tags/#data-destruction) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Conti Common Exec parameter](/endpoint/conti_common_exec_parameter/) | [User Execution](/tags/#user-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Control Loading from World Writable Directory](/endpoint/control_loading_from_world_writable_directory/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Control Panel](/tags/#control-panel) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Control Loading from World Writable Directory](/endpoint/control_loading_from_world_writable_directory/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Control Panel](/tags/#control-panel) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Correlation by Repository and Risk](/cloud/correlation_by_repository_and_risk/) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution) | [Correlation](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Correlation by User and Risk](/cloud/correlation_by_user_and_risk/) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution) | [Correlation](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Create Remote Thread In Shell Application](/endpoint/create_remote_thread_in_shell_application/) | [Process Injection](/tags/#process-injection) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -125,7 +125,7 @@ sidebar: | [DLLHost with no Command Line Arguments with Network](/endpoint/dllhost_with_no_command_line_arguments_with_network/) | [Process Injection](/tags/#process-injection) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [DNS Exfiltration Using Nslookup App](/endpoint/dns_exfiltration_using_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [DNS Query Length Outliers - MLTK](/network/dns_query_length_outliers_-_mltk/) | [DNS](/tags/#dns), [Application Layer Protocol](/tags/#application-layer-protocol) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [DNS Query Length With High Standard Deviation](/network/dns_query_length_with_high_standard_deviation/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [DNS Query Length With High Standard Deviation](/network/dns_query_length_with_high_standard_deviation/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [DNS Query Requests Resolved by Unauthorized DNS Servers](/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers/) | [DNS](/tags/#dns) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [DNS record changed](/deprecated/dns_record_changed/) | [DNS](/tags/#dns) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [DSQuery Domain Discovery](/endpoint/dsquery_domain_discovery/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -155,14 +155,14 @@ sidebar: | [Detect Exchange Web Shell](/endpoint/detect_exchange_web_shell/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Detect F5 TMUI RCE CVE-2020-5902](/web/detect_f5_tmui_rce_cve-2020-5902/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Detect GCP Storage access from a new IP](/cloud/detect_gcp_storage_access_from_a_new_ip/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Detect HTML Help Renamed](/endpoint/detect_html_help_renamed/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Detect HTML Help Spawn Child Process](/endpoint/detect_html_help_spawn_child_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Detect HTML Help URL in Command Line](/endpoint/detect_html_help_url_in_command_line/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Detect HTML Help Using InfoTech Storage Handlers](/endpoint/detect_html_help_using_infotech_storage_handlers/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Detect HTML Help Renamed](/endpoint/detect_html_help_renamed/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Detect HTML Help Spawn Child Process](/endpoint/detect_html_help_spawn_child_process/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Detect HTML Help URL in Command Line](/endpoint/detect_html_help_url_in_command_line/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Detect HTML Help Using InfoTech Storage Handlers](/endpoint/detect_html_help_using_infotech_storage_handlers/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Detect IPv6 Network Infrastructure Threats](/network/detect_ipv6_network_infrastructure_threats/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Detect Large Outbound ICMP Packets](/network/detect_large_outbound_icmp_packets/) | [Non-Application Layer Protocol](/tags/#non-application-layer-protocol) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Detect Long DNS TXT Record Response](/deprecated/detect_long_dns_txt_record_response/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Detect MSHTA Url in Command Line](/endpoint/detect_mshta_url_in_command_line/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Detect Long DNS TXT Record Response](/deprecated/detect_long_dns_txt_record_response/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Detect MSHTA Url in Command Line](/endpoint/detect_mshta_url_in_command_line/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Detect Mimikatz Using Loaded Images](/endpoint/detect_mimikatz_using_loaded_images/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Detect Mimikatz Via PowerShell And EventCode 4703](/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703/) | [LSASS Memory](/tags/#lsass-memory) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Detect Mimikatz With PowerShell Script Block Logging](/endpoint/detect_mimikatz_with_powershell_script_block_logging/) | [OS Credential Dumping](/tags/#os-credential-dumping) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -180,22 +180,22 @@ sidebar: | [Detect PsExec With accepteula Flag](/endpoint/detect_psexec_with_accepteula_flag/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Detect RClone Command-Line Usage](/endpoint/detect_rclone_command-line_usage/) | [Automated Exfiltration](/tags/#automated-exfiltration) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Detect Rare Executables](/endpoint/detect_rare_executables/) | None | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Detect Regasm Spawning a Process](/endpoint/detect_regasm_spawning_a_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Detect Regasm with Network Connection](/endpoint/detect_regasm_with_network_connection/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Detect Regasm with no Command Line Arguments](/endpoint/detect_regasm_with_no_command_line_arguments/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Detect Regsvcs Spawning a Process](/endpoint/detect_regsvcs_spawning_a_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Detect Regsvcs with Network Connection](/endpoint/detect_regsvcs_with_network_connection/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Detect Regsvcs with No Command Line Arguments](/endpoint/detect_regsvcs_with_no_command_line_arguments/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Detect Regsvr32 Application Control Bypass](/endpoint/detect_regsvr32_application_control_bypass/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Detect Regasm Spawning a Process](/endpoint/detect_regasm_spawning_a_process/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Detect Regasm with Network Connection](/endpoint/detect_regasm_with_network_connection/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Detect Regasm with no Command Line Arguments](/endpoint/detect_regasm_with_no_command_line_arguments/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Detect Regsvcs Spawning a Process](/endpoint/detect_regsvcs_spawning_a_process/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Detect Regsvcs with Network Connection](/endpoint/detect_regsvcs_with_network_connection/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Detect Regsvcs with No Command Line Arguments](/endpoint/detect_regsvcs_with_no_command_line_arguments/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Detect Regsvr32 Application Control Bypass](/endpoint/detect_regsvr32_application_control_bypass/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Detect Renamed 7-Zip](/endpoint/detect_renamed_7-zip/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Detect Renamed PSExec](/endpoint/detect_renamed_psexec/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Detect Renamed RClone](/endpoint/detect_renamed_rclone/) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Detect Renamed WinRAR](/endpoint/detect_renamed_winrar/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Detect Rogue DHCP Server](/network/detect_rogue_dhcp_server/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Detect Rundll32 Application Control Bypass - advpack](/endpoint/detect_rundll32_application_control_bypass_-_advpack/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Detect Rundll32 Application Control Bypass - setupapi](/endpoint/detect_rundll32_application_control_bypass_-_setupapi/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Detect Rundll32 Application Control Bypass - syssetup](/endpoint/detect_rundll32_application_control_bypass_-_syssetup/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Detect Rundll32 Inline HTA Execution](/endpoint/detect_rundll32_inline_hta_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Detect Rundll32 Application Control Bypass - advpack](/endpoint/detect_rundll32_application_control_bypass_-_advpack/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Detect Rundll32 Application Control Bypass - setupapi](/endpoint/detect_rundll32_application_control_bypass_-_setupapi/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Detect Rundll32 Application Control Bypass - syssetup](/endpoint/detect_rundll32_application_control_bypass_-_syssetup/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Detect Rundll32 Inline HTA Execution](/endpoint/detect_rundll32_inline_hta_execution/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Detect S3 access from a new IP](/cloud/detect_s3_access_from_a_new_ip/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Detect SNICat SNI Exfiltration](/network/detect_snicat_sni_exfiltration/) | [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Detect SharpHound Command-Line Arguments](/endpoint/detect_sharphound_command-line_arguments/) | [Domain Account](/tags/#domain-account), [Local Groups](/tags/#local-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Local Account](/tags/#local-account), [Account Discovery](/tags/#account-discovery), [Domain Groups](/tags/#domain-groups), [Permission Groups Discovery](/tags/#permission-groups-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -220,14 +220,14 @@ sidebar: | [Detect attackers scanning for vulnerable JBoss servers](/web/detect_attackers_scanning_for_vulnerable_jboss_servers/) | [System Information Discovery](/tags/#system-information-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Detect hosts connecting to dynamic domain providers](/network/detect_hosts_connecting_to_dynamic_domain_providers/) | [Drive-by Compromise](/tags/#drive-by-compromise) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Detect malicious requests to exploit JBoss servers](/web/detect_malicious_requests_to_exploit_jboss_servers/) | None | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Detect mshta inline hta execution](/endpoint/detect_mshta_inline_hta_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Detect mshta renamed](/endpoint/detect_mshta_renamed/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Detect mshta inline hta execution](/endpoint/detect_mshta_inline_hta_execution/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Detect mshta renamed](/endpoint/detect_mshta_renamed/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Detect new API calls from user roles](/deprecated/detect_new_api_calls_from_user_roles/) | [Cloud Accounts](/tags/#cloud-accounts) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Detect new user AWS Console Login](/deprecated/detect_new_user_aws_console_login/) | [Cloud Accounts](/tags/#cloud-accounts) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Detect processes used for System Network Configuration Discovery](/endpoint/detect_processes_used_for_system_network_configuration_discovery/) | [System Network Configuration Discovery](/tags/#system-network-configuration-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Detect shared ec2 snapshot](/cloud/detect_shared_ec2_snapshot/) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Detect web traffic to dynamic domain providers](/deprecated/detect_web_traffic_to_dynamic_domain_providers/) | [Web Protocols](/tags/#web-protocols) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Detection of DNS Tunnels](/deprecated/detection_of_dns_tunnels/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Detection of DNS Tunnels](/deprecated/detection_of_dns_tunnels/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Detection of tools built by NirSoft](/endpoint/detection_of_tools_built_by_nirsoft/) | [Software Deployment Tools](/tags/#software-deployment-tools) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Disable AMSI Through Registry](/endpoint/disable_amsi_through_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Disable Defender AntiVirus Registry](/endpoint/disable_defender_antivirus_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -377,7 +377,7 @@ sidebar: | [Gsuite Drive Share In External Email](/cloud/gsuite_drive_share_in_external_email/) | [Exfiltration to Cloud Storage](/tags/#exfiltration-to-cloud-storage), [Exfiltration Over Web Service](/tags/#exfiltration-over-web-service) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Gsuite Email Suspicious Subject With Attachment](/cloud/gsuite_email_suspicious_subject_with_attachment/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Gsuite Email With Known Abuse Web Service Link](/cloud/gsuite_email_with_known_abuse_web_service_link/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Gsuite Outbound Email With Attachment To External Domain](/cloud/gsuite_outbound_email_with_attachment_to_external_domain/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Gsuite Outbound Email With Attachment To External Domain](/cloud/gsuite_outbound_email_with_attachment_to_external_domain/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Gsuite Suspicious Shared File Name](/cloud/gsuite_suspicious_shared_file_name/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Gsuite suspicious calendar invite](/cloud/gsuite_suspicious_calendar_invite/) | [Phishing](/tags/#phishing) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Hide User Account From Sign-In Screen](/endpoint/hide_user_account_from_sign-in_screen/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -431,7 +431,7 @@ sidebar: | [Linux Add User Account](/endpoint/linux_add_user_account/) | [Local Account](/tags/#local-account), [Create Account](/tags/#create-account) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Linux Adding Crontab Using List Parameter](/endpoint/linux_adding_crontab_using_list_parameter/) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Linux At Allow Config File Creation](/endpoint/linux_at_allow_config_file_creation/) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Linux At Application Execution](/endpoint/linux_at_application_execution/) | [At (Linux)](/tags/#at-(linux)), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Linux At Application Execution](/endpoint/linux_at_application_execution/) | [At](/tags/#at), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Linux Change File Owner To Root](/endpoint/linux_change_file_owner_to_root/) | [Linux and Mac File and Directory Permissions Modification](/tags/#linux-and-mac-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Linux Common Process For Elevation Control](/endpoint/linux_common_process_for_elevation_control/) | [Setuid and Setgid](/tags/#setuid-and-setgid), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Linux DD File Overwrite](/endpoint/linux_dd_file_overwrite/) | [Data Destruction](/tags/#data-destruction) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -458,7 +458,7 @@ sidebar: | [Linux Possible Access Or Modification Of sshd Config File](/endpoint/linux_possible_access_or_modification_of_sshd_config_file/) | [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Linux Possible Access To Credential Files](/endpoint/linux_possible_access_to_credential_files/) | [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Linux Possible Access To Sudoers File](/endpoint/linux_possible_access_to_sudoers_file/) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Linux Possible Append Command To At Allow Config File](/endpoint/linux_possible_append_command_to_at_allow_config_file/) | [At (Linux)](/tags/#at-(linux)), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Linux Possible Append Command To At Allow Config File](/endpoint/linux_possible_append_command_to_at_allow_config_file/) | [At](/tags/#at), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Linux Possible Append Command To Profile Config File](/endpoint/linux_possible_append_command_to_profile_config_file/) | [Unix Shell Configuration Modification](/tags/#unix-shell-configuration-modification), [Event Triggered Execution](/tags/#event-triggered-execution) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Linux Possible Append Cronjob Entry on Existing Cronjob File](/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file/) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Linux Possible Cronjob Modification With Editor](/endpoint/linux_possible_cronjob_modification_with_editor/) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -492,7 +492,7 @@ sidebar: | [MSI Module Loaded by Non-System Binary](/endpoint/msi_module_loaded_by_non-system_binary/) | [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [MacOS - Re-opened Applications](/endpoint/macos_-_re-opened_applications/) | None | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [MacOS LOLbin](/endpoint/macos_lolbin/) | [Unix Shell](/tags/#unix-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [MacOS plutil](/endpoint/macos_plutil/) | [Plist Modification](/tags/#plist-modification) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [MacOS plutil](/endpoint/macos_plutil/) | [Plist File Modification](/tags/#plist-file-modification) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Mailsniper Invoke functions](/endpoint/mailsniper_invoke_functions/) | [Email Collection](/tags/#email-collection), [Local Email Collection](/tags/#local-email-collection) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Malicious InProcServer32 Modification](/endpoint/malicious_inprocserver32_modification/) | [Regsvr32](/tags/#regsvr32), [Modify Registry](/tags/#modify-registry) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Malicious PowerShell Process - Encoded Command](/endpoint/malicious_powershell_process_-_encoded_command/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -507,9 +507,9 @@ sidebar: | [Monitor Email For Brand Abuse](/application/monitor_email_for_brand_abuse/) | None | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Monitor Registry Keys for Print Monitors](/endpoint/monitor_registry_keys_for_print_monitors/) | [Port Monitors](/tags/#port-monitors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Monitor Web Traffic For Brand Abuse](/web/monitor_web_traffic_for_brand_abuse/) | None | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Mshta spawning Rundll32 OR Regsvr32 Process](/endpoint/mshta_spawning_rundll32_or_regsvr32_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Mshta spawning Rundll32 OR Regsvr32 Process](/endpoint/mshta_spawning_rundll32_or_regsvr32_process/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Msmpeng Application DLL Side Loading](/endpoint/msmpeng_application_dll_side_loading/) | [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Multiple Archive Files Http Post Traffic](/network/multiple_archive_files_http_post_traffic/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Multiple Archive Files Http Post Traffic](/network/multiple_archive_files_http_post_traffic/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Multiple Invalid Users Failing To Authenticate From Host Using NTLM](/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Multiple Okta Users With Invalid Credentials From The Same IP](/application/multiple_okta_users_with_invalid_credentials_from_the_same_ip/) | [Valid Accounts](/tags/#valid-accounts), [Default Accounts](/tags/#default-accounts) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Multiple Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -546,7 +546,7 @@ sidebar: | [Office Document Creating Schedule Task](/endpoint/office_document_creating_schedule_task/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Office Document Executing Macro Code](/endpoint/office_document_executing_macro_code/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Office Document Spawned Child Process To Download](/endpoint/office_document_spawned_child_process_to_download/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Office Product Spawn CMD Process](/endpoint/office_product_spawn_cmd_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Office Product Spawn CMD Process](/endpoint/office_product_spawn_cmd_process/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Office Product Spawning BITSAdmin](/endpoint/office_product_spawning_bitsadmin/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Office Product Spawning CertUtil](/endpoint/office_product_spawning_certutil/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Office Product Spawning MSHTA](/endpoint/office_product_spawning_mshta/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -567,7 +567,7 @@ sidebar: | [PetitPotam Network Share Access Request](/endpoint/petitpotam_network_share_access_request/) | [Forced Authentication](/tags/#forced-authentication) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [PetitPotam Suspicious Kerberos TGT Request](/endpoint/petitpotam_suspicious_kerberos_tgt_request/) | [OS Credential Dumping](/tags/#os-credential-dumping) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Ping Sleep Batch Command](/endpoint/ping_sleep_batch_command/) | [Virtualization/Sandbox Evasion](/tags/#virtualization/sandbox-evasion), [Time Based Evasion](/tags/#time-based-evasion) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Plain HTTP POST Exfiltrated Data](/network/plain_http_post_exfiltrated_data/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Plain HTTP POST Exfiltrated Data](/network/plain_http_post_exfiltrated_data/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Possible Browser Pass View Parameter](/endpoint/possible_browser_pass_view_parameter/) | [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Credentials from Password Stores](/tags/#credentials-from-password-stores) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Possible Lateral Movement PowerShell Spawn](/endpoint/possible_lateral_movement_powershell_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Potentially malicious code on commandline](/endpoint/potentially_malicious_code_on_commandline/) | [Windows Command Shell](/tags/#windows-command-shell) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -603,7 +603,7 @@ sidebar: | [Processes launching netsh](/endpoint/processes_launching_netsh/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Prohibited Network Traffic Allowed](/network/prohibited_network_traffic_allowed/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Prohibited Software On Endpoint](/deprecated/prohibited_software_on_endpoint/) | None | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Protocol or Port Mismatch](/network/protocol_or_port_mismatch/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Protocol or Port Mismatch](/network/protocol_or_port_mismatch/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Protocols passing authentication in cleartext](/network/protocols_passing_authentication_in_cleartext/) | None | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Randomly Generated Scheduled Task Name](/endpoint/randomly_generated_scheduled_task_name/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Scheduled Task](/tags/#scheduled-task) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Randomly Generated Windows Service Name](/endpoint/randomly_generated_windows_service_name/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -616,8 +616,8 @@ sidebar: | [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Registry Keys Used For Privilege Escalation](/endpoint/registry_keys_used_for_privilege_escalation/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Event Triggered Execution](/tags/#event-triggered-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Registry Keys for Creating SHIM Databases](/endpoint/registry_keys_for_creating_shim_databases/) | [Application Shimming](/tags/#application-shimming), [Event Triggered Execution](/tags/#event-triggered-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Regsvr32 Silent and Install Param Dll Loading](/endpoint/regsvr32_silent_and_install_param_dll_loading/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Regsvr32 with Known Silent Switch Cmdline](/endpoint/regsvr32_with_known_silent_switch_cmdline/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Regsvr32 Silent and Install Param Dll Loading](/endpoint/regsvr32_silent_and_install_param_dll_loading/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Regsvr32 with Known Silent Switch Cmdline](/endpoint/regsvr32_with_known_silent_switch_cmdline/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Remcos RAT File Creation in Remcos Folder](/endpoint/remcos_rat_file_creation_in_remcos_folder/) | [Screen Capture](/tags/#screen-capture) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Remcos client registry install entry](/endpoint/remcos_client_registry_install_entry/) | [Modify Registry](/tags/#modify-registry) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Remote Desktop Network Bruteforce](/network/remote_desktop_network_bruteforce/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -642,16 +642,16 @@ sidebar: | [Revil Registry Entry](/endpoint/revil_registry_entry/) | [Modify Registry](/tags/#modify-registry) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Rubeus Command Line Parameters](/endpoint/rubeus_command_line_parameters/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Ticket](/tags/#pass-the-ticket), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Kerberoasting](/tags/#kerberoasting), [AS-REP Roasting](/tags/#as-rep-roasting) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Rubeus Kerberos Ticket Exports Through Winlogon Access](/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Ticket](/tags/#pass-the-ticket) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [RunDLL Loading DLL By Ordinal](/endpoint/rundll_loading_dll_by_ordinal/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [RunDLL Loading DLL By Ordinal](/endpoint/rundll_loading_dll_by_ordinal/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Runas Execution in CommandLine](/endpoint/runas_execution_in_commandline/) | [Access Token Manipulation](/tags/#access-token-manipulation), [Token Impersonation/Theft](/tags/#token-impersonation/theft) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Rundll32 Control RunDLL Hunt](/endpoint/rundll32_control_rundll_hunt/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Rundll32 Control RunDLL World Writable Directory](/endpoint/rundll32_control_rundll_world_writable_directory/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Rundll32 Control RunDLL Hunt](/endpoint/rundll32_control_rundll_hunt/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Rundll32 Control RunDLL World Writable Directory](/endpoint/rundll32_control_rundll_world_writable_directory/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Rundll32 Create Remote Thread To A Process](/endpoint/rundll32_create_remote_thread_to_a_process/) | [Process Injection](/tags/#process-injection) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Rundll32 CreateRemoteThread In Browser](/endpoint/rundll32_createremotethread_in_browser/) | [Process Injection](/tags/#process-injection) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Rundll32 DNSQuery](/endpoint/rundll32_dnsquery/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Rundll32 Process Creating Exe Dll Files](/endpoint/rundll32_process_creating_exe_dll_files/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Rundll32 DNSQuery](/endpoint/rundll32_dnsquery/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Rundll32 Process Creating Exe Dll Files](/endpoint/rundll32_process_creating_exe_dll_files/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Rundll32 Shimcache Flush](/endpoint/rundll32_shimcache_flush/) | [Modify Registry](/tags/#modify-registry) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Rundll32 with no Command Line Arguments with Network](/endpoint/rundll32_with_no_command_line_arguments_with_network/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Rundll32 with no Command Line Arguments with Network](/endpoint/rundll32_with_no_command_line_arguments_with_network/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Ryuk Test Files Detected](/endpoint/ryuk_test_files_detected/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Ryuk Wake on LAN Command](/endpoint/ryuk_wake_on_lan_command/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [SAM Database File Access Attempt](/endpoint/sam_database_file_access_attempt/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -665,7 +665,7 @@ sidebar: | [SchCache Change By App Connect And Create ADSI Object](/endpoint/schcache_change_by_app_connect_and_create_adsi_object/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Schedule Task with HTTP Command Arguments](/endpoint/schedule_task_with_http_command_arguments/) | [Scheduled Task/Job](/tags/#scheduled-task/job) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Schedule Task with Rundll32 Command Trigger](/endpoint/schedule_task_with_rundll32_command_trigger/) | [Scheduled Task/Job](/tags/#scheduled-task/job) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Scheduled Task Creation on Remote Endpoint using At](/endpoint/scheduled_task_creation_on_remote_endpoint_using_at/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [At (Windows)](/tags/#at-(windows)) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Scheduled Task Creation on Remote Endpoint using At](/endpoint/scheduled_task_creation_on_remote_endpoint_using_at/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [At](/tags/#at) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Scheduled Task Deleted Or Created via CMD](/endpoint/scheduled_task_deleted_or_created_via_cmd/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Scheduled Task Initiation on Remote Endpoint](/endpoint/scheduled_task_initiation_on_remote_endpoint/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Scheduled Task](/tags/#scheduled-task) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Scheduled tasks used in BadRabbit ransomware](/deprecated/scheduled_tasks_used_in_badrabbit_ransomware/) | [Scheduled Task](/tags/#scheduled-task) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -715,7 +715,7 @@ sidebar: | [Suspicious Event Log Service Behavior](/endpoint/suspicious_event_log_service_behavior/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Suspicious File Write](/deprecated/suspicious_file_write/) | None | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Suspicious GPUpdate no Command Line Arguments](/endpoint/suspicious_gpupdate_no_command_line_arguments/) | [Process Injection](/tags/#process-injection) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Suspicious IcedID Rundll32 Cmdline](/endpoint/suspicious_icedid_rundll32_cmdline/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Suspicious IcedID Rundll32 Cmdline](/endpoint/suspicious_icedid_rundll32_cmdline/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Suspicious Image Creation In Appdata Folder](/endpoint/suspicious_image_creation_in_appdata_folder/) | [Screen Capture](/tags/#screen-capture) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Suspicious Java Classes](/application/suspicious_java_classes/) | None | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Suspicious Kerberos Service Ticket Request](/endpoint/suspicious_kerberos_service_ticket_request/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -729,12 +729,12 @@ sidebar: | [Suspicious Process File Path](/endpoint/suspicious_process_file_path/) | [Create or Modify System Process](/tags/#create-or-modify-system-process) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Suspicious Process With Discord DNS Query](/endpoint/suspicious_process_with_discord_dns_query/) | [Visual Basic](/tags/#visual-basic), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Suspicious Reg exe Process](/endpoint/suspicious_reg_exe_process/) | [Modify Registry](/tags/#modify-registry) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Suspicious Regsvr32 Register Suspicious Path](/endpoint/suspicious_regsvr32_register_suspicious_path/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Suspicious Rundll32 PluginInit](/endpoint/suspicious_rundll32_plugininit/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Suspicious Rundll32 Rename](/deprecated/suspicious_rundll32_rename/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Masquerading](/tags/#masquerading), [Rundll32](/tags/#rundll32), [Rename System Utilities](/tags/#rename-system-utilities) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Suspicious Rundll32 StartW](/endpoint/suspicious_rundll32_startw/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Suspicious Rundll32 dllregisterserver](/endpoint/suspicious_rundll32_dllregisterserver/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Suspicious Rundll32 no Command Line Arguments](/endpoint/suspicious_rundll32_no_command_line_arguments/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Suspicious Regsvr32 Register Suspicious Path](/endpoint/suspicious_regsvr32_register_suspicious_path/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Suspicious Rundll32 PluginInit](/endpoint/suspicious_rundll32_plugininit/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Suspicious Rundll32 Rename](/deprecated/suspicious_rundll32_rename/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Masquerading](/tags/#masquerading), [Rundll32](/tags/#rundll32), [Rename System Utilities](/tags/#rename-system-utilities) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Suspicious Rundll32 StartW](/endpoint/suspicious_rundll32_startw/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Suspicious Rundll32 dllregisterserver](/endpoint/suspicious_rundll32_dllregisterserver/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Suspicious Rundll32 no Command Line Arguments](/endpoint/suspicious_rundll32_no_command_line_arguments/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Suspicious SQLite3 LSQuarantine Behavior](/endpoint/suspicious_sqlite3_lsquarantine_behavior/) | [Data Staged](/tags/#data-staged) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Suspicious SearchProtocolHost no Command Line Arguments](/endpoint/suspicious_searchprotocolhost_no_command_line_arguments/) | [Process Injection](/tags/#process-injection) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -743,8 +743,8 @@ sidebar: | [Suspicious microsoft workflow compiler rename](/endpoint/suspicious_microsoft_workflow_compiler_rename/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Suspicious microsoft workflow compiler usage](/endpoint/suspicious_microsoft_workflow_compiler_usage/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Suspicious msbuild path](/endpoint/suspicious_msbuild_path/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Suspicious mshta child process](/endpoint/suspicious_mshta_child_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Suspicious mshta spawn](/endpoint/suspicious_mshta_spawn/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Suspicious mshta child process](/endpoint/suspicious_mshta_child_process/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Suspicious mshta spawn](/endpoint/suspicious_mshta_spawn/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Suspicious wevtutil Usage](/endpoint/suspicious_wevtutil_usage/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Suspicious writes to System Volume Information](/deprecated/suspicious_writes_to_system_volume_information/) | [Masquerading](/tags/#masquerading) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Suspicious writes to windows Recycle Bin](/endpoint/suspicious_writes_to_windows_recycle_bin/) | [Masquerading](/tags/#masquerading) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -758,11 +758,11 @@ sidebar: | [Time Provider Persistence Registry](/endpoint/time_provider_persistence_registry/) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Trickbot Named Pipe](/endpoint/trickbot_named_pipe/) | [Process Injection](/tags/#process-injection) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [UAC Bypass MMC Load Unsigned Dll](/endpoint/uac_bypass_mmc_load_unsigned_dll/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [UAC Bypass With Colorui COM Object](/endpoint/uac_bypass_with_colorui_com_object/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [UAC Bypass With Colorui COM Object](/endpoint/uac_bypass_with_colorui_com_object/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [CMSTP](/tags/#cmstp) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [USN Journal Deletion](/endpoint/usn_journal_deletion/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Uncommon Processes On Endpoint](/deprecated/uncommon_processes_on_endpoint/) | [Malicious File](/tags/#malicious-file) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Unified Messaging Service Spawning a Process](/endpoint/unified_messaging_service_spawning_a_process/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Uninstall App Using MsiExec](/endpoint/uninstall_app_using_msiexec/) | [Msiexec](/tags/#msiexec), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Uninstall App Using MsiExec](/endpoint/uninstall_app_using_msiexec/) | [Msiexec](/tags/#msiexec), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Unknown Process Using The Kerberos Protocol](/endpoint/unknown_process_using_the_kerberos_protocol/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Unload Sysmon Filter Driver](/endpoint/unload_sysmon_filter_driver/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Unloading AMSI via Reflection](/endpoint/unloading_amsi_via_reflection/) | [Impair Defenses](/tags/#impair-defenses), [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -779,7 +779,7 @@ sidebar: | [VMware Server Side Template Injection Hunt](/web/vmware_server_side_template_injection_hunt/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [VMware Workspace ONE Freemarker Server-side Template Injection](/web/vmware_workspace_one_freemarker_server-side_template_injection/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Vbscript Execution Using Wscript App](/endpoint/vbscript_execution_using_wscript_app/) | [Visual Basic](/tags/#visual-basic), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Verclsid CLSID Execution](/endpoint/verclsid_clsid_execution/) | [Verclsid](/tags/#verclsid), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Verclsid CLSID Execution](/endpoint/verclsid_clsid_execution/) | [Verclsid](/tags/#verclsid), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [W3WP Spawning Shell](/endpoint/w3wp_spawning_shell/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [WBAdmin Delete System Backups](/endpoint/wbadmin_delete_system_backups/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [WMI Permanent Event Subscription](/endpoint/wmi_permanent_event_subscription/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -788,7 +788,7 @@ sidebar: | [WMI Temporary Event Subscription](/endpoint/wmi_temporary_event_subscription/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [WMIC XSL Execution via URL](/endpoint/wmic_xsl_execution_via_url/) | [XSL Script Processing](/tags/#xsl-script-processing) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [WSReset UAC Bypass](/endpoint/wsreset_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Wbemprox COM Object Execution](/endpoint/wbemprox_com_object_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Wbemprox COM Object Execution](/endpoint/wbemprox_com_object_execution/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [CMSTP](/tags/#cmstp) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Web Fraud - Account Harvesting](/deprecated/web_fraud_-_account_harvesting/) | [Create Account](/tags/#create-account) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Web Fraud - Anomalous User Clickspeed](/deprecated/web_fraud_-_anomalous_user_clickspeed/) | [Valid Accounts](/tags/#valid-accounts) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Web Fraud - Password Sharing Across Accounts](/deprecated/web_fraud_-_password_sharing_across_accounts/) | None | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -823,8 +823,8 @@ sidebar: | [Windows DisableAntiSpyware Registry](/endpoint/windows_disableantispyware_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Disabled Users Failing To Authenticate Kerberos](/endpoint/windows_disabled_users_failing_to_authenticate_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows DiskCryptor Usage](/endpoint/windows_diskcryptor_usage/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Windows Diskshadow Proxy Execution](/endpoint/windows_diskshadow_proxy_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Windows DotNet Binary in Non Standard Path](/endpoint/windows_dotnet_binary_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows Diskshadow Proxy Execution](/endpoint/windows_diskshadow_proxy_execution/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows DotNet Binary in Non Standard Path](/endpoint/windows_dotnet_binary_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [InstallUtil](/tags/#installutil) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Driver Load Non-Standard Path](/endpoint/windows_driver_load_non-standard_path/) | [Rootkit](/tags/#rootkit) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Drivers Loaded by Signature](/endpoint/windows_drivers_loaded_by_signature/) | [Rootkit](/tags/#rootkit), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Event For Service Disabled](/endpoint/windows_event_for_service_disabled/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -839,12 +839,12 @@ sidebar: | [Windows ISO LNK File Creation](/endpoint/windows_iso_lnk_file_creation/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing), [Malicious Link](/tags/#malicious-link), [User Execution](/tags/#user-execution) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Indirect Command Execution Via forfiles](/endpoint/windows_indirect_command_execution_via_forfiles/) | [Indirect Command Execution](/tags/#indirect-command-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Indirect Command Execution Via pcalua](/endpoint/windows_indirect_command_execution_via_pcalua/) | [Indirect Command Execution](/tags/#indirect-command-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Windows InstallUtil Credential Theft](/endpoint/windows_installutil_credential_theft/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Windows InstallUtil Remote Network Connection](/endpoint/windows_installutil_remote_network_connection/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Windows InstallUtil URL in Command Line](/endpoint/windows_installutil_url_in_command_line/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Windows InstallUtil Uninstall Option](/endpoint/windows_installutil_uninstall_option/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Windows InstallUtil Uninstall Option with Network](/endpoint/windows_installutil_uninstall_option_with_network/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Windows InstallUtil in Non Standard Path](/endpoint/windows_installutil_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows InstallUtil Credential Theft](/endpoint/windows_installutil_credential_theft/) | [InstallUtil](/tags/#installutil), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows InstallUtil Remote Network Connection](/endpoint/windows_installutil_remote_network_connection/) | [InstallUtil](/tags/#installutil), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows InstallUtil URL in Command Line](/endpoint/windows_installutil_url_in_command_line/) | [InstallUtil](/tags/#installutil), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows InstallUtil Uninstall Option](/endpoint/windows_installutil_uninstall_option/) | [InstallUtil](/tags/#installutil), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows InstallUtil Uninstall Option with Network](/endpoint/windows_installutil_uninstall_option_with_network/) | [InstallUtil](/tags/#installutil), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows InstallUtil in Non Standard Path](/endpoint/windows_installutil_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [InstallUtil](/tags/#installutil) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Invalid Users Failed Authentication via Kerberos](/endpoint/windows_invalid_users_failed_authentication_via_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Java Spawning Shells](/endpoint/windows_java_spawning_shells/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Kerberos Local Successful Logon](/endpoint/windows_kerberos_local_successful_logon/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -860,7 +860,7 @@ sidebar: | [Windows Process With NamedPipe CommandLine](/endpoint/windows_process_with_namedpipe_commandline/) | [Process Injection](/tags/#process-injection) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Processes Killed By Industroyer2 Malware](/endpoint/windows_processes_killed_by_industroyer2_malware/) | [Service Stop](/tags/#service-stop) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Raccine Scheduled Task Deletion](/endpoint/windows_raccine_scheduled_task_deletion/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Windows Rasautou DLL Execution](/endpoint/windows_rasautou_dll_execution/) | [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Process Injection](/tags/#process-injection) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows Rasautou DLL Execution](/endpoint/windows_rasautou_dll_execution/) | [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Process Injection](/tags/#process-injection) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Raw Access To Disk Volume Partition](/endpoint/windows_raw_access_to_disk_volume_partition/) | [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Raw Access To Master Boot Record Drive](/endpoint/windows_raw_access_to_master_boot_record_drive/) | [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Registry Certificate Added](/endpoint/windows_registry_certificate_added/) | [Install Root Certificate](/tags/#install-root-certificate), [Subvert Trust Controls](/tags/#subvert-trust-controls) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | diff --git a/docs/_pages/stories.md b/docs/_pages/stories.md index 829e607eae..204865e2ab 100644 --- a/docs/_pages/stories.md +++ b/docs/_pages/stories.md @@ -14,42 +14,42 @@ sidebar: | [AWS Cryptomining](aws_cryptomining) | [Cloud Accounts](/tags/#cloud-accounts), [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [AWS IAM Privilege Escalation](aws_iam_privilege_escalation) | [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts), [Cloud Account](/tags/#cloud-account), [Create Account](/tags/#create-account), [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery), [Brute Force](/tags/#brute-force), [Account Manipulation](/tags/#account-manipulation), [Cloud Groups](/tags/#cloud-groups), [Permission Groups Discovery](/tags/#permission-groups-discovery) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [AWS Network ACL Activity](aws_network_acl_activity) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses) | [Defense Evasion](/tags/#defense-evasion) | -| [AWS Security Hub Alerts]() | None | None | +| [AWS Security Hub Alerts](aws_security_hub_alerts) | None | None | | [AWS Suspicious Provisioning Activities](aws_suspicious_provisioning_activities) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) | | [AWS User Monitoring](aws_user_monitoring) | [Cloud Service Discovery](/tags/#cloud-service-discovery), [Cloud Accounts](/tags/#cloud-accounts) | [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [AcidRain](acidrain) | [Data Destruction](/tags/#data-destruction), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact) | | [Active Directory Discovery](active_directory_discovery) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery), [Remote System Discovery](/tags/#remote-system-discovery), [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Password Policy Discovery](/tags/#password-policy-discovery), [Local Groups](/tags/#local-groups), [System Owner/User Discovery](/tags/#system-owner/user-discovery), [Local Account](/tags/#local-account), [System Network Connections Discovery](/tags/#system-network-connections-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Internet Connection Discovery](/tags/#internet-connection-discovery), [Kerberoasting](/tags/#kerberoasting), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Credential Access](/tags/#credential-access), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Active Directory Kerberos Attacks](active_directory_kerberos_attacks) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [AS-REP Roasting](/tags/#as-rep-roasting), [Kerberoasting](/tags/#kerberoasting), [Golden Ticket](/tags/#golden-ticket), [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Gather Victim Identity Information](/tags/#gather-victim-identity-information), [Email Addresses](/tags/#email-addresses), [Pass the Ticket](/tags/#pass-the-ticket), [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force), [OS Credential Dumping](/tags/#os-credential-dumping), [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts), [Remote System Discovery](/tags/#remote-system-discovery) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) | -| [Active Directory Lateral Movement](active_directory_lateral_movement) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Hash](/tags/#pass-the-hash), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service), [Windows Remote Management](/tags/#windows-remote-management), [Scheduled Task](/tags/#scheduled-task), [PowerShell](/tags/#powershell), [Scheduled Task/Job](/tags/#scheduled-task/job), [At (Windows)](/tags/#at-(windows)), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | +| [Active Directory Lateral Movement](active_directory_lateral_movement) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Hash](/tags/#pass-the-hash), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service), [Windows Remote Management](/tags/#windows-remote-management), [Scheduled Task](/tags/#scheduled-task), [PowerShell](/tags/#powershell), [Scheduled Task/Job](/tags/#scheduled-task/job), [At](/tags/#at), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Active Directory Password Spraying](active_directory_password_spraying) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | [Credential Access](/tags/#credential-access) | | [Apache Struts Vulnerability](apache_struts_vulnerability) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) | -| [Asset Tracking]() | None | None | +| [Asset Tracking](asset_tracking) | None | None | | [BITS Jobs](bits_jobs) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence) | | [Baron Samedit CVE-2021-3156](baron_samedit_cve-2021-3156) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) | | [BlackMatter Ransomware](blackmatter_ransomware) | [Credentials in Registry](/tags/#credentials-in-registry), [Unsecured Credentials](/tags/#unsecured-credentials), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Defacement](/tags/#defacement), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Credential Access](/tags/#credential-access), [Impact](/tags/#impact) | -| [Brand Monitoring]() | None | None | +| [Brand Monitoring](brand_monitoring) | None | None | | [Caddy Wiper](caddy_wiper) | [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe) | [Impact](/tags/#impact) | | [Clop Ransomware](clop_ransomware) | [User Execution](/tags/#user-execution), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Data Destruction](/tags/#data-destruction), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Cloud Cryptomining](cloud_cryptomining) | [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts), [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Cloud Federated Credential Abuse](cloud_federated_credential_abuse) | [Valid Accounts](/tags/#valid-accounts), [Cloud Account](/tags/#cloud-account), [Create Account](/tags/#create-account), [Modify Authentication Process](/tags/#modify-authentication-process), [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Event Triggered Execution](/tags/#event-triggered-execution) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | -| [Cobalt Strike](cobalt_strike) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Process Injection](/tags/#process-injection), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32), [Rundll32](/tags/#rundll32), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild) | [Collection](/tags/#collection), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | -| [ColdRoot MacOS RAT]() | None | None | +| [Cobalt Strike](cobalt_strike) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Process Injection](/tags/#process-injection), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32), [Rundll32](/tags/#rundll32), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild) | [Collection](/tags/#collection), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | +| [ColdRoot MacOS RAT](coldroot_macos_rat) | None | None | | [Collection and Staging](collection_and_staging) | [Masquerading](/tags/#masquerading), [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Email Collection](/tags/#email-collection), [Local Email Collection](/tags/#local-email-collection), [Remote Email Collection](/tags/#remote-email-collection) | [Collection](/tags/#collection), [Defense Evasion](/tags/#defense-evasion) | -| [Command and Control](command_and_control) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [DNS](/tags/#dns), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols), [Drive-by Compromise](/tags/#drive-by-compromise) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access) | +| [Command and Control](command_and_control) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [DNS](/tags/#dns), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols), [Drive-by Compromise](/tags/#drive-by-compromise) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access) | | [Common Phishing Frameworks](common_phishing_frameworks) | [Spearphishing via Service](/tags/#spearphishing-via-service) | [Initial Access](/tags/#initial-access) | | [Container Implantation Monitoring and Investigation](container_implantation_monitoring_and_investigation) | [Implant Internal Image](/tags/#implant-internal-image) | [Persistence](/tags/#persistence) | | [Credential Dumping](credential_dumping) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager), [NTDS](/tags/#ntds), [Modify Registry](/tags/#modify-registry), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution) | | [CyclopsBLink](cyclopsblink) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses), [Masquerade Task or Service](/tags/#masquerade-task-or-service), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) | | [DHS Report TA18-074A](dhs_report_ta18-074a) | [PowerShell](/tags/#powershell), [Windows Command Shell](/tags/#windows-command-shell), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job), [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file), [Modify Registry](/tags/#modify-registry), [File Transfer Protocols](/tags/#file-transfer-protocols), [Application Layer Protocol](/tags/#application-layer-protocol) | [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [DNS Amplification Attacks](dns_amplification_attacks) | [Network Denial of Service](/tags/#network-denial-of-service), [Reflection Amplification](/tags/#reflection-amplification) | [Impact](/tags/#impact) | -| [DNS Hijacking](dns_hijacking) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [DNS](/tags/#dns), [Drive-by Compromise](/tags/#drive-by-compromise) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access) | -| [DarkSide Ransomware](darkside_ransomware) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp), [Process Injection](/tags/#process-injection), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [LSASS Memory](/tags/#lsass-memory), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Automated Exfiltration](/tags/#automated-exfiltration), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | -| [Data Destruction](data_destruction) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Masquerading](/tags/#masquerading), [Data Destruction](/tags/#data-destruction), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Modify Registry](/tags/#modify-registry), [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | -| [Data Exfiltration](data_exfiltration) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Local Email Collection](/tags/#local-email-collection), [Phishing](/tags/#phishing), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | [Collection](/tags/#collection), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access) | -| [Data Protection](data_protection) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Drive-by Compromise](/tags/#drive-by-compromise) | [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access) | +| [DNS Hijacking](dns_hijacking) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [DNS](/tags/#dns), [Drive-by Compromise](/tags/#drive-by-compromise) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access) | +| [DarkSide Ransomware](darkside_ransomware) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [CMSTP](/tags/#cmstp), [Process Injection](/tags/#process-injection), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [LSASS Memory](/tags/#lsass-memory), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Automated Exfiltration](/tags/#automated-exfiltration), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | +| [Data Destruction](data_destruction) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Masquerading](/tags/#masquerading), [Data Destruction](/tags/#data-destruction), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Modify Registry](/tags/#modify-registry), [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | +| [Data Exfiltration](data_exfiltration) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Local Email Collection](/tags/#local-email-collection), [Phishing](/tags/#phishing), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol) | [Collection](/tags/#collection), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access) | +| [Data Protection](data_protection) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Drive-by Compromise](/tags/#drive-by-compromise) | [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access) | | [Deobfuscate-Decode Files or Information](deobfuscate-decode_files_or_information) | [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information) | [Defense Evasion](/tags/#defense-evasion) | | [Detect Zerologon Attack](detect_zerologon_attack) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping), [Exploitation of Remote Services](/tags/#exploitation-of-remote-services), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Credential Access](/tags/#credential-access), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement) | -| [Dev Sec Ops](dev_sec_ops) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Compromise Software Supply Chain](/tags/#compromise-software-supply-chain), [Supply Chain Compromise](/tags/#supply-chain-compromise), [Trusted Relationship](/tags/#trusted-relationship), [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Exfiltration to Cloud Storage](/tags/#exfiltration-to-cloud-storage), [Exfiltration Over Web Service](/tags/#exfiltration-over-web-service), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Exploitation for Credential Access](/tags/#exploitation-for-credential-access), [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Credential Access](/tags/#credential-access), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) | +| [Dev Sec Ops](dev_sec_ops) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Compromise Software Supply Chain](/tags/#compromise-software-supply-chain), [Supply Chain Compromise](/tags/#supply-chain-compromise), [Trusted Relationship](/tags/#trusted-relationship), [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Exfiltration to Cloud Storage](/tags/#exfiltration-to-cloud-storage), [Exfiltration Over Web Service](/tags/#exfiltration-over-web-service), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing), [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Exploitation for Credential Access](/tags/#exploitation-for-credential-access), [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Credential Access](/tags/#credential-access), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) | | [Disabling Security Tools](disabling_security_tools) | [Install Root Certificate](/tags/#install-root-certificate), [Subvert Trust Controls](/tags/#subvert-trust-controls), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Modify Registry](/tags/#modify-registry) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Domain Trust Discovery](domain_trust_discovery) | [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) | | [Double Zero Destructor](double_zero_destructor) | [Masquerading](/tags/#masquerading), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Modify Registry](/tags/#modify-registry), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | @@ -60,87 +60,87 @@ sidebar: | [FIN7](fin7) | [System Owner/User Discovery](/tags/#system-owner/user-discovery), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Visual Basic](/tags/#visual-basic), [Process Injection](/tags/#process-injection), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation), [XSL Script Processing](/tags/#xsl-script-processing) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [GCP Cross Account Activity](gcp_cross_account_activity) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [HAFNIUM Group](hafnium_group) | [LSASS Memory](/tags/#lsass-memory), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [OS Credential Dumping](/tags/#os-credential-dumping), [NTDS](/tags/#ntds), [Email Collection](/tags/#email-collection), [Remote Email Collection](/tags/#remote-email-collection) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence) | -| [Hermetic Wiper](hermetic_wiper) | [PowerShell](/tags/#powershell), [Malicious File](/tags/#malicious-file), [Active Setup](/tags/#active-setup), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution), [Windows Command Shell](/tags/#windows-command-shell), [OS Credential Dumping](/tags/#os-credential-dumping), [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Impair Defenses](/tags/#impair-defenses), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Masquerading](/tags/#masquerading), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Kerberoasting](/tags/#kerberoasting), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Logon Script (Windows)](/tags/#logon-script-(windows)), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Accessibility Features](/tags/#accessibility-features), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Process Injection](/tags/#process-injection), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32), [Access Token Manipulation](/tags/#access-token-manipulation), [Token Impersonation/Theft](/tags/#token-impersonation/theft), [Screensaver](/tags/#screensaver), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Time Providers](/tags/#time-providers), [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Data Destruction](/tags/#data-destruction), [Modify Registry](/tags/#modify-registry), [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Print Processors](/tags/#print-processors) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) | -| [Hidden Cobra Malware](hidden_cobra_malware) | [PowerShell](/tags/#powershell), [Windows Command Shell](/tags/#windows-command-shell), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Network Share Connection Removal](/tags/#network-share-connection-removal), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services), [File Transfer Protocols](/tags/#file-transfer-protocols), [Application Layer Protocol](/tags/#application-layer-protocol), [DNS](/tags/#dns), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Lateral Movement](/tags/#lateral-movement) | -| [Host Redirection](host_redirection) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [DNS](/tags/#dns) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration) | -| [IcedID](icedid) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell), [Process Injection](/tags/#process-injection), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Modify Registry](/tags/#modify-registry), [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Regsvr32](/tags/#regsvr32), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data from Local System](/tags/#data-from-local-system), [Scheduled Task](/tags/#scheduled-task) | [Collection](/tags/#collection), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | +| [Hermetic Wiper](hermetic_wiper) | [PowerShell](/tags/#powershell), [Malicious File](/tags/#malicious-file), [Active Setup](/tags/#active-setup), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution), [Windows Command Shell](/tags/#windows-command-shell), [OS Credential Dumping](/tags/#os-credential-dumping), [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Impair Defenses](/tags/#impair-defenses), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Masquerading](/tags/#masquerading), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Kerberoasting](/tags/#kerberoasting), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Logon Script (Windows)](/tags/#logon-script-(windows)), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Accessibility Features](/tags/#accessibility-features), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Process Injection](/tags/#process-injection), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32), [Access Token Manipulation](/tags/#access-token-manipulation), [Token Impersonation/Theft](/tags/#token-impersonation/theft), [Screensaver](/tags/#screensaver), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Time Providers](/tags/#time-providers), [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Data Destruction](/tags/#data-destruction), [Modify Registry](/tags/#modify-registry), [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Print Processors](/tags/#print-processors) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) | +| [Hidden Cobra Malware](hidden_cobra_malware) | [PowerShell](/tags/#powershell), [Windows Command Shell](/tags/#windows-command-shell), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Network Share Connection Removal](/tags/#network-share-connection-removal), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services), [File Transfer Protocols](/tags/#file-transfer-protocols), [Application Layer Protocol](/tags/#application-layer-protocol), [DNS](/tags/#dns), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Lateral Movement](/tags/#lateral-movement) | +| [Host Redirection](host_redirection) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [DNS](/tags/#dns) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration) | +| [IcedID](icedid) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell), [Process Injection](/tags/#process-injection), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Modify Registry](/tags/#modify-registry), [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Regsvr32](/tags/#regsvr32), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data from Local System](/tags/#data-from-local-system), [Scheduled Task](/tags/#scheduled-task) | [Collection](/tags/#collection), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Industroyer2](industroyer2) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery), [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [LSASS Memory](/tags/#lsass-memory), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Masquerading](/tags/#masquerading), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service), [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data Destruction](/tags/#data-destruction), [Service Stop](/tags/#service-stop), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Scheduled Task](/tags/#scheduled-task), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) | | [Information Sabotage](information_sabotage) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | [Exfiltration](/tags/#exfiltration) | | [Ingress Tool Transfer](ingress_tool_transfer) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [BITS Jobs](/tags/#bits-jobs) | [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence) | -| [Insider Threat](insider_threat) | [Exfiltration to Cloud Storage](/tags/#exfiltration-to-cloud-storage), [Exfiltration Over Web Service](/tags/#exfiltration-over-web-service), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | [Credential Access](/tags/#credential-access), [Exfiltration](/tags/#exfiltration) | +| [Insider Threat](insider_threat) | [Exfiltration to Cloud Storage](/tags/#exfiltration-to-cloud-storage), [Exfiltration Over Web Service](/tags/#exfiltration-over-web-service), [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | [Credential Access](/tags/#credential-access), [Exfiltration](/tags/#exfiltration) | | [JBoss Vulnerability](jboss_vulnerability) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) | | [Kubernetes Scanning Activity](kubernetes_scanning_activity) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) | -| [Kubernetes Sensitive Object Access Activity]() | None | None | -| [Kubernetes Sensitive Role Activity]() | None | None | -| [Linux Persistence Techniques](linux_persistence_techniques) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [At (Linux)](/tags/#at-(linux)), [Linux and Mac File and Directory Permissions Modification](/tags/#linux-and-mac-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Setuid and Setgid](/tags/#setuid-and-setgid), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [RC Scripts](/tags/#rc-scripts), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Unix Shell Configuration Modification](/tags/#unix-shell-configuration-modification), [Event Triggered Execution](/tags/#event-triggered-execution), [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation), [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping), [Dynamic Linker Hijacking](/tags/#dynamic-linker-hijacking), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Systemd Timers](/tags/#systemd-timers), [Data Destruction](/tags/#data-destruction) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | +| [Kubernetes Sensitive Object Access Activity](kubernetes_sensitive_object_access_activity) | None | None | +| [Kubernetes Sensitive Role Activity](kubernetes_sensitive_role_activity) | None | None | +| [Linux Persistence Techniques](linux_persistence_techniques) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [At](/tags/#at), [Linux and Mac File and Directory Permissions Modification](/tags/#linux-and-mac-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Setuid and Setgid](/tags/#setuid-and-setgid), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [RC Scripts](/tags/#rc-scripts), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Unix Shell Configuration Modification](/tags/#unix-shell-configuration-modification), [Event Triggered Execution](/tags/#event-triggered-execution), [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation), [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping), [Dynamic Linker Hijacking](/tags/#dynamic-linker-hijacking), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Systemd Timers](/tags/#systemd-timers), [Data Destruction](/tags/#data-destruction) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Linux Post-Exploitation](linux_post-exploitation) | [Unix Shell](/tags/#unix-shell) | [Execution](/tags/#execution) | -| [Linux Privilege Escalation](linux_privilege_escalation) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [At (Linux)](/tags/#at-(linux)), [Linux and Mac File and Directory Permissions Modification](/tags/#linux-and-mac-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Setuid and Setgid](/tags/#setuid-and-setgid), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [RC Scripts](/tags/#rc-scripts), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Unix Shell Configuration Modification](/tags/#unix-shell-configuration-modification), [Event Triggered Execution](/tags/#event-triggered-execution), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation), [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping), [Dynamic Linker Hijacking](/tags/#dynamic-linker-hijacking), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Systemd Timers](/tags/#systemd-timers), [Data Destruction](/tags/#data-destruction) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | -| [Living Off The Land](living_off_the_land) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Control Panel](/tags/#control-panel), [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping), [Compiled HTML File](/tags/#compiled-html-file), [Mshta](/tags/#mshta), [Regsvcs/Regasm](/tags/#regsvcs/regasm), [Regsvr32](/tags/#regsvr32), [Rundll32](/tags/#rundll32), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [LSASS Memory](/tags/#lsass-memory), [Security Account Manager](/tags/#security-account-manager), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Unix Shell](/tags/#unix-shell), [Plist Modification](/tags/#plist-modification), [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Process Injection](/tags/#process-injection), [Modify Registry](/tags/#modify-registry), [Scheduled Task/Job](/tags/#scheduled-task/job), [At (Windows)](/tags/#at-(windows)), [Scheduled Task](/tags/#scheduled-task), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service), [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild), [Indirect Command Execution](/tags/#indirect-command-execution), [InstallUtil](/tags/#installutil) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | +| [Linux Privilege Escalation](linux_privilege_escalation) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [At](/tags/#at), [Linux and Mac File and Directory Permissions Modification](/tags/#linux-and-mac-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Setuid and Setgid](/tags/#setuid-and-setgid), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [RC Scripts](/tags/#rc-scripts), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Unix Shell Configuration Modification](/tags/#unix-shell-configuration-modification), [Event Triggered Execution](/tags/#event-triggered-execution), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation), [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping), [Dynamic Linker Hijacking](/tags/#dynamic-linker-hijacking), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Systemd Timers](/tags/#systemd-timers), [Data Destruction](/tags/#data-destruction) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | +| [Living Off The Land](living_off_the_land) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Control Panel](/tags/#control-panel), [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping), [Compiled HTML File](/tags/#compiled-html-file), [Mshta](/tags/#mshta), [Regsvcs/Regasm](/tags/#regsvcs/regasm), [Regsvr32](/tags/#regsvr32), [Rundll32](/tags/#rundll32), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [LSASS Memory](/tags/#lsass-memory), [Security Account Manager](/tags/#security-account-manager), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Unix Shell](/tags/#unix-shell), [Plist File Modification](/tags/#plist-file-modification), [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Process Injection](/tags/#process-injection), [Modify Registry](/tags/#modify-registry), [Scheduled Task/Job](/tags/#scheduled-task/job), [At](/tags/#at), [Scheduled Task](/tags/#scheduled-task), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service), [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild), [Indirect Command Execution](/tags/#indirect-command-execution), [InstallUtil](/tags/#installutil) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Local Privilege Escalation With KrbRelayUp](local_privilege_escalation_with_krbrelayup) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Windows Service](/tags/#windows-service) | [Credential Access](/tags/#credential-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Log4Shell CVE-2021-44228](log4shell_cve-2021-44228) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Windows Command Shell](/tags/#windows-command-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Command And Control](/tags/#command-and-control), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access) | | [Malicious PowerShell](malicious_powershell) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [OS Credential Dumping](/tags/#os-credential-dumping), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [Process Injection](/tags/#process-injection), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Impair Defenses](/tags/#impair-defenses) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) | -| [Masquerading - Rename System Utilities](masquerading_-_rename_system_utilities) | [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Masquerading](/tags/#masquerading), [Rundll32](/tags/#rundll32), [Data Destruction](/tags/#data-destruction), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [MSBuild](/tags/#msbuild), [InstallUtil](/tags/#installutil) | [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact) | +| [Masquerading - Rename System Utilities](masquerading_-_rename_system_utilities) | [Rename System Utilities](/tags/#rename-system-utilities), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Masquerading](/tags/#masquerading), [Rundll32](/tags/#rundll32), [Data Destruction](/tags/#data-destruction), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [MSBuild](/tags/#msbuild), [InstallUtil](/tags/#installutil) | [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact) | | [Meterpreter](meterpreter) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Execution](/tags/#execution) | -| [Microsoft MSHTML Remote Code Execution CVE-2021-40444](microsoft_mshtml_remote_code_execution_cve-2021-40444) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Control Panel](/tags/#control-panel), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access) | -| [Monitor Backup Solution]() | None | None | +| [Microsoft MSHTML Remote Code Execution CVE-2021-40444](microsoft_mshtml_remote_code_execution_cve-2021-40444) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Control Panel](/tags/#control-panel), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access) | +| [Monitor Backup Solution](monitor_backup_solution) | None | None | | [Monitor for Unauthorized Software](monitor_for_unauthorized_software) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Masquerading](/tags/#masquerading), [OS Credential Dumping](/tags/#os-credential-dumping), [Active Scanning](/tags/#active-scanning) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Reconnaissance](/tags/#reconnaissance) | -| [Monitor for Updates]() | None | None | -| [NOBELIUM Group](nobelium_group) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job), [Remote System Discovery](/tags/#remote-system-discovery), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [File Transfer Protocols](/tags/#file-transfer-protocols), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols), [Web Shell](/tags/#web-shell) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | +| [Monitor for Updates](monitor_for_updates) | None | None | +| [NOBELIUM Group](nobelium_group) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job), [Remote System Discovery](/tags/#remote-system-discovery), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Exploitation for Client Execution](/tags/#exploitation-for-client-execution), [File Transfer Protocols](/tags/#file-transfer-protocols), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols), [Web Shell](/tags/#web-shell) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Netsh Abuse](netsh_abuse) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses) | [Defense Evasion](/tags/#defense-evasion) | | [Network Discovery](network_discovery) | [System Network Configuration Discovery](/tags/#system-network-configuration-discovery) | [Discovery](/tags/#discovery) | | [Office 365 Detections](office_365_detections) | [Cloud Account](/tags/#cloud-account), [Create Account](/tags/#create-account), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses), [Modify Authentication Process](/tags/#modify-authentication-process), [Brute Force](/tags/#brute-force), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Remote Email Collection](/tags/#remote-email-collection), [Password Guessing](/tags/#password-guessing) | [Collection](/tags/#collection), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence) | | [Orangeworm Attack Group](orangeworm_attack_group) | [PowerShell](/tags/#powershell), [Windows Command Shell](/tags/#windows-command-shell), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [PetitPotam NTLM Relay on Active Directory Certificate Services](petitpotam_ntlm_relay_on_active_directory_certificate_services) | [Forced Authentication](/tags/#forced-authentication), [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access) | | [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns) | [PowerShell](/tags/#powershell), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | -| [PrintNightmare CVE-2021-34527](printnightmare_cve-2021-34527) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | -| [Prohibited Traffic Allowed or Protocol Mismatch](prohibited_traffic_allowed_or_protocol_mismatch) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols), [Drive-by Compromise](/tags/#drive-by-compromise) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement) | +| [PrintNightmare CVE-2021-34527](printnightmare_cve-2021-34527) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | +| [Prohibited Traffic Allowed or Protocol Mismatch](prohibited_traffic_allowed_or_protocol_mismatch) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols), [Drive-by Compromise](/tags/#drive-by-compromise) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement) | | [ProxyShell](proxyshell) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) | -| [Ransomware](ransomware) | [Scheduled Task](/tags/#scheduled-task), [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp), [Data Destruction](/tags/#data-destruction), [User Execution](/tags/#user-execution), [Automated Exfiltration](/tags/#automated-exfiltration), [Domain Account](/tags/#domain-account), [Local Groups](/tags/#local-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Local Account](/tags/#local-account), [Account Discovery](/tags/#account-discovery), [Domain Groups](/tags/#domain-groups), [Permission Groups Discovery](/tags/#permission-groups-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Service Stop](/tags/#service-stop), [Account Access Removal](/tags/#account-access-removal), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Visual Basic](/tags/#visual-basic), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Modify Registry](/tags/#modify-registry), [Scheduled Task/Job](/tags/#scheduled-task/job), [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Msiexec](/tags/#msiexec), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [InstallUtil](/tags/#installutil), [Tool](/tags/#tool), [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance), [Resource Development](/tags/#resource-development) | +| [Ransomware](ransomware) | [Scheduled Task](/tags/#scheduled-task), [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [CMSTP](/tags/#cmstp), [Data Destruction](/tags/#data-destruction), [User Execution](/tags/#user-execution), [Automated Exfiltration](/tags/#automated-exfiltration), [Domain Account](/tags/#domain-account), [Local Groups](/tags/#local-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Local Account](/tags/#local-account), [Account Discovery](/tags/#account-discovery), [Domain Groups](/tags/#domain-groups), [Permission Groups Discovery](/tags/#permission-groups-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Service Stop](/tags/#service-stop), [Account Access Removal](/tags/#account-access-removal), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Visual Basic](/tags/#visual-basic), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Modify Registry](/tags/#modify-registry), [Scheduled Task/Job](/tags/#scheduled-task/job), [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Msiexec](/tags/#msiexec), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [InstallUtil](/tags/#installutil), [Tool](/tags/#tool), [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance), [Resource Development](/tags/#resource-development) | | [Ransomware Cloud](ransomware_cloud) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) | -| [Remcos](remcos) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript), [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Regsvr32](/tags/#regsvr32), [Modify Registry](/tags/#modify-registry), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Component Object Model](/tags/#component-object-model), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Screen Capture](/tags/#screen-capture), [Visual Basic](/tags/#visual-basic), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | [Collection](/tags/#collection), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) | -| [Revil Ransomware](revil_ransomware) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [User Execution](/tags/#user-execution), [Modify Registry](/tags/#modify-registry), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | +| [Remcos](remcos) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript), [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Regsvr32](/tags/#regsvr32), [Modify Registry](/tags/#modify-registry), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Component Object Model](/tags/#component-object-model), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Screen Capture](/tags/#screen-capture), [Visual Basic](/tags/#visual-basic), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | [Collection](/tags/#collection), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) | +| [Revil Ransomware](revil_ransomware) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [User Execution](/tags/#user-execution), [Modify Registry](/tags/#modify-registry), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Router and Infrastructure Security](router_and_infrastructure_security) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning), [TFTP Boot](/tags/#tftp-boot), [Pre-OS Boot](/tags/#pre-os-boot), [Automated Exfiltration](/tags/#automated-exfiltration), [Traffic Duplication](/tags/#traffic-duplication) | [Collection](/tags/#collection), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Exfiltration](/tags/#exfiltration), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) | | [Ryuk Ransomware](ryuk_ransomware) | [Windows Command Shell](/tags/#windows-command-shell), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Data Destruction](/tags/#data-destruction), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Service Stop](/tags/#service-stop), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [SQL Injection](sql_injection) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) | | [SamSam Ransomware](samsam_ransomware) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Masquerading](/tags/#masquerading), [OS Credential Dumping](/tags/#os-credential-dumping), [Active Scanning](/tags/#active-scanning), [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file), [Data Destruction](/tags/#data-destruction), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [System Information Discovery](/tags/#system-information-discovery) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Reconnaissance](/tags/#reconnaissance) | -| [Signed Binary Proxy Execution InstallUtil](signed_binary_proxy_execution_installutil) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil) | [Defense Evasion](/tags/#defense-evasion) | +| [Signed Binary Proxy Execution InstallUtil](signed_binary_proxy_execution_installutil) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [InstallUtil](/tags/#installutil) | [Defense Evasion](/tags/#defense-evasion) | | [Silver Sparrow](silver_sparrow) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Launch Agent](/tags/#launch-agent), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Data Staged](/tags/#data-staged) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Spearphishing Attachments](spearphishing_attachments) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Spearphishing Link](/tags/#spearphishing-link), [Malicious Link](/tags/#malicious-link), [User Execution](/tags/#user-execution) | [Credential Access](/tags/#credential-access), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access) | -| [Spectre And Meltdown Vulnerabilities]() | None | None | +| [Spectre And Meltdown Vulnerabilities](spectre_and_meltdown_vulnerabilities) | None | None | | [Splunk Vulnerabilities](splunk_vulnerabilities) | [File and Directory Discovery](/tags/#file-and-directory-discovery), [Network Denial of Service](/tags/#network-denial-of-service), [Valid Accounts](/tags/#valid-accounts), [Drive-by Compromise](/tags/#drive-by-compromise) | [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Spring4Shell CVE-2022-22965](spring4shell_cve-2022-22965) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Web Shell](/tags/#web-shell), [Server Software Component](/tags/#server-software-component) | [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) | | [Suspicious AWS EC2 Activities](suspicious_aws_ec2_activities) | [Cloud Accounts](/tags/#cloud-accounts), [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Suspicious AWS Login Activities](suspicious_aws_login_activities) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions), [Cloud Accounts](/tags/#cloud-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Suspicious AWS S3 Activities](suspicious_aws_s3_activities) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Collection](/tags/#collection) | -| [Suspicious AWS Traffic]() | None | None | +| [Suspicious AWS Traffic](suspicious_aws_traffic) | None | None | | [Suspicious Cloud Authentication Activities](suspicious_cloud_authentication_activities) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) | | [Suspicious Cloud Instance Activities](suspicious_cloud_instance_activities) | [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | [Defense Evasion](/tags/#defense-evasion), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Suspicious Cloud Provisioning Activities](suspicious_cloud_provisioning_activities) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Suspicious Cloud User Activities](suspicious_cloud_user_activities) | [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts), [Cloud Infrastructure Discovery](/tags/#cloud-infrastructure-discovery), [User Execution](/tags/#user-execution) | [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Suspicious Command-Line Executions](suspicious_command-line_executions) | [PowerShell](/tags/#powershell), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution) | -| [Suspicious Compiled HTML Activity](suspicious_compiled_html_activity) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | [Defense Evasion](/tags/#defense-evasion) | -| [Suspicious DNS Traffic](suspicious_dns_traffic) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [DNS](/tags/#dns), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Application Layer Protocol](/tags/#application-layer-protocol), [Drive-by Compromise](/tags/#drive-by-compromise) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access) | +| [Suspicious Compiled HTML Activity](suspicious_compiled_html_activity) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | [Defense Evasion](/tags/#defense-evasion) | +| [Suspicious DNS Traffic](suspicious_dns_traffic) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [DNS](/tags/#dns), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Application Layer Protocol](/tags/#application-layer-protocol), [Drive-by Compromise](/tags/#drive-by-compromise) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access) | | [Suspicious Emails](suspicious_emails) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Initial Access](/tags/#initial-access) | | [Suspicious GCP Storage Activities](suspicious_gcp_storage_activities) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [Collection](/tags/#collection) | -| [Suspicious MSHTA Activity](suspicious_mshta_activity) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | +| [Suspicious MSHTA Activity](suspicious_mshta_activity) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Suspicious Okta Activity](suspicious_okta_activity) | [Valid Accounts](/tags/#valid-accounts), [Default Accounts](/tags/#default-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | -| [Suspicious Regsvcs Regasm Activity](suspicious_regsvcs_regasm_activity) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [Defense Evasion](/tags/#defense-evasion) | -| [Suspicious Regsvr32 Activity](suspicious_regsvr32_activity) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32), [Modify Registry](/tags/#modify-registry) | [Defense Evasion](/tags/#defense-evasion) | -| [Suspicious Rundll32 Activity](suspicious_rundll32_activity) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Masquerading](/tags/#masquerading), [Rundll32](/tags/#rundll32), [Rename System Utilities](/tags/#rename-system-utilities), [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion) | +| [Suspicious Regsvcs Regasm Activity](suspicious_regsvcs_regasm_activity) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm) | [Defense Evasion](/tags/#defense-evasion) | +| [Suspicious Regsvr32 Activity](suspicious_regsvr32_activity) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32), [Modify Registry](/tags/#modify-registry) | [Defense Evasion](/tags/#defense-evasion) | +| [Suspicious Rundll32 Activity](suspicious_rundll32_activity) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Masquerading](/tags/#masquerading), [Rundll32](/tags/#rundll32), [Rename System Utilities](/tags/#rename-system-utilities), [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion) | | [Suspicious WMI Use](suspicious_wmi_use) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription), [Event Triggered Execution](/tags/#event-triggered-execution), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [XSL Script Processing](/tags/#xsl-script-processing) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Suspicious Windows Registry Activities](suspicious_windows_registry_activities) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Change Default File Association](/tags/#change-default-file-association), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Port Monitors](/tags/#port-monitors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Application Shimming](/tags/#application-shimming), [Event Triggered Execution](/tags/#event-triggered-execution), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Suspicious Zoom Child Processes](suspicious_zoom_child_processes) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Execution](/tags/#execution), [Privilege Escalation](/tags/#privilege-escalation) | -| [Trickbot](trickbot) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Process Injection](/tags/#process-injection), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Scheduled Task/Job](/tags/#scheduled-task/job), [Rundll32](/tags/#rundll32), [Gather Victim Network Information](/tags/#gather-victim-network-information), [IP Addresses](/tags/#ip-addresses), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) | +| [Trickbot](trickbot) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Process Injection](/tags/#process-injection), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Scheduled Task/Job](/tags/#scheduled-task/job), [Rundll32](/tags/#rundll32), [Gather Victim Network Information](/tags/#gather-victim-network-information), [IP Addresses](/tags/#ip-addresses), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) | | [Trusted Developer Utilities Proxy Execution](trusted_developer_utilities_proxy_execution) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | | [Trusted Developer Utilities Proxy Execution MSBuild](trusted_developer_utilities_proxy_execution_msbuild) | [MSBuild](/tags/#msbuild), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) | | [Unusual AWS EC2 Modifications](unusual_aws_ec2_modifications) | [Cloud Accounts](/tags/#cloud-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | -| [Unusual Processes](unusual_processes) | [Malicious File](/tags/#malicious-file), [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Masquerading](/tags/#masquerading), [OS Credential Dumping](/tags/#os-credential-dumping), [Active Scanning](/tags/#active-scanning), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Modify Registry](/tags/#modify-registry), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32), [Rename System Utilities](/tags/#rename-system-utilities), [Verclsid](/tags/#verclsid), [InstallUtil](/tags/#installutil), [Tool](/tags/#tool), [Process Injection](/tags/#process-injection), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance), [Resource Development](/tags/#resource-development) | -| [Use of Cleartext Protocols]() | None | None | +| [Unusual Processes](unusual_processes) | [Malicious File](/tags/#malicious-file), [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Masquerading](/tags/#masquerading), [OS Credential Dumping](/tags/#os-credential-dumping), [Active Scanning](/tags/#active-scanning), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Modify Registry](/tags/#modify-registry), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32), [Rename System Utilities](/tags/#rename-system-utilities), [Verclsid](/tags/#verclsid), [InstallUtil](/tags/#installutil), [Tool](/tags/#tool), [Process Injection](/tags/#process-injection), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance), [Resource Development](/tags/#resource-development) | +| [Use of Cleartext Protocols](use_of_cleartext_protocols) | None | None | | [VMware Server Side Injection and Privilege Escalation](vmware_server_side_injection_and_privilege_escalation) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) | | [Web Fraud Detection](web_fraud_detection) | [Create Account](/tags/#create-account), [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | -| [WhisperGate](whispergate) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Data Destruction](/tags/#data-destruction), [Masquerading](/tags/#masquerading), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Virtualization/Sandbox Evasion](/tags/#virtualization/sandbox-evasion), [Time Based Evasion](/tags/#time-based-evasion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Visual Basic](/tags/#visual-basic), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil), [Tool](/tags/#tool), [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe), [Process Injection](/tags/#process-injection), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Resource Development](/tags/#resource-development) | +| [WhisperGate](whispergate) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Data Destruction](/tags/#data-destruction), [Masquerading](/tags/#masquerading), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Virtualization/Sandbox Evasion](/tags/#virtualization/sandbox-evasion), [Time Based Evasion](/tags/#time-based-evasion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Visual Basic](/tags/#visual-basic), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [InstallUtil](/tags/#installutil), [Tool](/tags/#tool), [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe), [Process Injection](/tags/#process-injection), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Resource Development](/tags/#resource-development) | | [Windows DNS SIGRed CVE-2020-1350](windows_dns_sigred_cve-2020-1350) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [Execution](/tags/#execution) | -| [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Compile After Delivery](/tags/#compile-after-delivery), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Modify Registry](/tags/#modify-registry), [Hide Artifacts](/tags/#hide-artifacts), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact), [Privilege Escalation](/tags/#privilege-escalation) | +| [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Compile After Delivery](/tags/#compile-after-delivery), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Modify Registry](/tags/#modify-registry), [Hide Artifacts](/tags/#hide-artifacts), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution) | [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact), [Privilege Escalation](/tags/#privilege-escalation) | | [Windows Discovery Techniques](windows_discovery_techniques) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) | | [Windows Drivers](windows_drivers) | [Rootkit](/tags/#rootkit), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Install Root Certificate](/tags/#install-root-certificate), [Subvert Trust Controls](/tags/#subvert-trust-controls), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Windows File Extension and Association Abuse](windows_file_extension_and_association_abuse) | [Rename System Utilities](/tags/#rename-system-utilities), [Change Default File Association](/tags/#change-default-file-association), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | diff --git a/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md b/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md index ee70d544cf..9dc55bf436 100644 --- a/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md +++ b/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md @@ -93,7 +93,7 @@ The search is used to detect systems that are still vulnerable to the Spectre an -#### Search +#### Search ``` @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **spectre_and_meltdown_vulnerable_systems_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **spectre_and_meltdown_vulnerable_systems_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,6 +135,9 @@ It is possible that your vulnerability scanner is not detecting that the patches | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md index 18ca498df3..4d77ce3131 100644 --- a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md +++ b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md @@ -13,7 +13,7 @@ tags: - Authentication --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -89,7 +89,7 @@ The search queries the authentication logs for assets that are categorized as ro -#### Search +#### Search ``` @@ -107,7 +107,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_new_login_attempts_to_routers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_new_login_attempts_to_routers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,6 +136,9 @@ Legitimate router connections may appear as new connections | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md b/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md index e9d2bb9c62..2e5dcb136e 100644 --- a/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md +++ b/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md @@ -84,7 +84,7 @@ This search returns a list of hosts that have not successfully completed a backu -#### Search +#### Search ``` `netbackup` MESSAGE="Disk/Partition backup completed successfully." @@ -99,10 +99,11 @@ This search returns a list of hosts that have not successfully completed a backu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **extended_period_without_successful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **extended_period_without_successful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -129,6 +130,9 @@ None identified | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2017-09-12-identify_new_user_accounts.md b/docs/_posts/2017-09-12-identify_new_user_accounts.md index 4eee978935..34f43c8fec 100644 --- a/docs/_posts/2017-09-12-identify_new_user_accounts.md +++ b/docs/_posts/2017-09-12-identify_new_user_accounts.md @@ -95,7 +95,7 @@ This detection search will help profile user accounts in your environment by ide -#### Search +#### Search ``` @@ -112,7 +112,8 @@ This detection search will help profile user accounts in your environment by ide The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **identify_new_user_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **identify_new_user_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ If the Identity_Management data model is not updated regularly, this search coul | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md b/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md index 3039602cef..bfdc420f58 100644 --- a/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md +++ b/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md @@ -84,7 +84,7 @@ This search gives you the hosts where a backup was attempted and then failed. -#### Search +#### Search ``` `netbackup` @@ -98,10 +98,11 @@ This search gives you the hosts where a backup was attempted and then failed. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **unsuccessful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **unsuccessful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -126,6 +127,9 @@ None identified | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md index e0a9cd30c1..046f43a870 100644 --- a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md +++ b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md @@ -13,7 +13,7 @@ tags: - Network_Sessions --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -90,7 +90,7 @@ By populating the organization's assets within the assets_by_str.csv, we will be -#### Search +#### Search ``` @@ -109,7 +109,8 @@ By populating the organization's assets within the assets_by_str.csv, we will be The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_unauthorized_assets_by_mac_address_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_unauthorized_assets_by_mac_address_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ This search might be prone to high false positives. Please consider this when co | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md index ce0d9691c0..0c61516252 100644 --- a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md +++ b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md @@ -13,7 +13,7 @@ tags: - Updates --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -88,7 +88,7 @@ This search looks for Windows endpoints that have not generated an event indicat -#### Search +#### Search ``` @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **no_windows_updates_in_a_time_frame_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **no_windows_updates_in_a_time_frame_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ None identified | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md index 65550f0b6e..ded38404ae 100644 --- a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md +++ b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md @@ -13,7 +13,7 @@ tags: - Email --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -87,7 +87,7 @@ Attackers often use spaces as a means to obfuscate an attachment's file extensio -#### Search +#### Search ``` @@ -106,7 +106,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **email_attachments_with_lots_of_spaces_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **email_attachments_with_lots_of_spaces_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +141,9 @@ None at this time | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2017-09-19-open_redirect_in_splunk_web.md b/docs/_posts/2017-09-19-open_redirect_in_splunk_web.md index 85c9f4f16e..26e58dd350 100644 --- a/docs/_posts/2017-09-19-open_redirect_in_splunk_web.md +++ b/docs/_posts/2017-09-19-open_redirect_in_splunk_web.md @@ -96,7 +96,7 @@ This search allows you to look for evidence of exploitation for CVE-2016-4859, t -#### Search +#### Search ``` index=_internal sourcetype=splunk_web_access return_to="/%09/*" @@ -106,7 +106,8 @@ index=_internal sourcetype=splunk_web_access return_to="/%09/*" #### Macros The SPL above uses the following Macros: -Note that **open_redirect_in_splunk_web_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **open_redirect_in_splunk_web_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,6 +132,9 @@ None identified | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md index 4ac78ce5c2..9ecc7eda5b 100644 --- a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md +++ b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md @@ -19,7 +19,7 @@ tags: - Network_Resolution --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -103,7 +103,7 @@ The search is used to identify attempts to use your DNS Infrastructure for DDoS -#### Search +#### Search ``` @@ -117,7 +117,8 @@ The search is used to identify attempts to use your DNS Infrastructure for DDoS The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **large_volume_of_dns_any_queries_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **large_volume_of_dns_any_queries_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ Legitimate ANY requests may trigger this search, however it is unusual to see a | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md index 6d777b0bec..6e77e339c2 100644 --- a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md @@ -16,7 +16,7 @@ tags: - Web --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -91,7 +91,7 @@ This search looks for specific GET or HEAD requests to web servers that are indi -#### Search +#### Search ``` @@ -107,7 +107,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_attackers_scanning_for_vulnerable_jboss_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_attackers_scanning_for_vulnerable_jboss_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ It's possible for legitimate HTTP requests to be made to URLs containing the sus | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md index eb31202874..b7f1c3032e 100644 --- a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md @@ -13,7 +13,7 @@ tags: - Web --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -94,7 +94,7 @@ This search is used to detect malicious HTTP requests crafted to exploit jmx-con -#### Search +#### Search ``` @@ -112,7 +112,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_malicious_requests_to_exploit_jboss_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_malicious_requests_to_exploit_jboss_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ No known false positives for this detection. | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md index 7f0bb1f458..dd69d086cf 100644 --- a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md @@ -82,7 +82,7 @@ This search looks for DNS requests for faux domains similar to the domains that -#### Search +#### Search ``` @@ -99,7 +99,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [brand_abuse_dns](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_dns.yml) -Note that **monitor_dns_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **monitor_dns_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -124,6 +125,9 @@ None at this time | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md index f1c8dcccfe..3f11380515 100644 --- a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md @@ -13,7 +13,7 @@ tags: - Web --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -87,7 +87,7 @@ This search looks for Web requests to faux domains similar to the one that you w -#### Search +#### Search ``` @@ -104,7 +104,8 @@ The SPL above uses the following Macros: * [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **monitor_web_traffic_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **monitor_web_traffic_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,6 +132,9 @@ None at this time | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2017-10-13-unusually_long_content-type_length.md b/docs/_posts/2017-10-13-unusually_long_content-type_length.md index 0cef4d96df..4c03057b2b 100644 --- a/docs/_posts/2017-10-13-unusually_long_content-type_length.md +++ b/docs/_posts/2017-10-13-unusually_long_content-type_length.md @@ -12,7 +12,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -95,7 +95,7 @@ This search looks for unusually long strings in the Content-Type http header tha -#### Search +#### Search ``` `stream_http` @@ -109,7 +109,8 @@ This search looks for unusually long strings in the Content-Type http header tha The SPL above uses the following Macros: * [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) -Note that **unusually_long_content-type_length_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **unusually_long_content-type_length_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ Very few legitimate Content-Type fields will have a length greater than 100 char | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2017-11-27-detect_usb_device_insertion.md b/docs/_posts/2017-11-27-detect_usb_device_insertion.md index a4ae59c1cf..7a0d809cf9 100644 --- a/docs/_posts/2017-11-27-detect_usb_device_insertion.md +++ b/docs/_posts/2017-11-27-detect_usb_device_insertion.md @@ -87,7 +87,7 @@ The search is used to detect hosts that generate Windows Event ID 4663 for succe -#### Search +#### Search ``` @@ -103,7 +103,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_usb_device_insertion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_usb_device_insertion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,6 +133,9 @@ Legitimate USB activity will also be detected. Please verify and investigate as | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md index cf435ecadf..4dace7f9d7 100644 --- a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md +++ b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md @@ -13,7 +13,7 @@ tags: - Email --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -87,7 +87,7 @@ This search looks for emails claiming to be sent from a domain similar to one th -#### Search +#### Search ``` @@ -108,7 +108,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **monitor_email_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **monitor_email_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -142,6 +143,9 @@ None at this time | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md b/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md index b52a8e07ad..0998e6e218 100644 --- a/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md +++ b/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md @@ -93,7 +93,7 @@ This search looks for AWS CloudTrail events where an instance is started in a pa -#### Search +#### Search ``` `cloudtrail` earliest=-1h StartInstances @@ -113,7 +113,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **ec2_instance_started_in_previously_unseen_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **ec2_instance_started_in_previously_unseen_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +141,9 @@ It's possible that a user has unknowingly started an instance in a new region. P | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md b/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md index c6419fbeb3..bd0d436951 100644 --- a/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md +++ b/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md @@ -84,7 +84,7 @@ This search looks for EC2 instances being created with previously unseen AMIs. -#### Search +#### Search ``` `cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunInstances errorCode=success @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **ec2_instance_started_with_previously_unseen_ami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **ec2_instance_started_with_previously_unseen_ami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ After a new AMI is created, the first systems created with that AMI will cause t | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_city.md b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_city.md index 1dbd1197c1..97754107f3 100644 --- a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_city.md +++ b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_city.md @@ -92,7 +92,7 @@ This search looks for AWS provisioning activities from previously unseen cities. -#### Search +#### Search ``` `cloudtrail` (eventName=Run* OR eventName=Create*) @@ -118,7 +118,8 @@ This search looks for AWS provisioning activities from previously unseen cities. The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_cloud_provisioning_from_previously_unseen_city_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_cloud_provisioning_from_previously_unseen_city_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ This is a strictly behavioral search, so we define "false positive" slightly dif | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_country.md b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_country.md index 61fc3c3c1e..ef8a7cc9fe 100644 --- a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_country.md +++ b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_country.md @@ -92,7 +92,7 @@ This search looks for AWS provisioning activities from previously unseen countri -#### Search +#### Search ``` `cloudtrail` (eventName=Run* OR eventName=Create*) @@ -118,7 +118,8 @@ This search looks for AWS provisioning activities from previously unseen countri The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_cloud_provisioning_from_previously_unseen_country_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_cloud_provisioning_from_previously_unseen_country_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ This is a strictly behavioral search, so we define "false positive" slightly dif | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_ip_address.md b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_ip_address.md index 4609b44e68..11f4920b3b 100644 --- a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_ip_address.md +++ b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_ip_address.md @@ -84,7 +84,7 @@ This search looks for AWS provisioning activities from previously unseen IP addr -#### Search +#### Search ``` `cloudtrail` (eventName=Run* OR eventName=Create*) [search `cloudtrail` (eventName=Run* OR eventName=Create*) @@ -108,7 +108,8 @@ This search looks for AWS provisioning activities from previously unseen IP addr The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_cloud_provisioning_from_previously_unseen_ip_address_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_cloud_provisioning_from_previously_unseen_ip_address_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,6 +137,9 @@ This is a strictly behavioral search, so we define "false positive" slightly dif | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_region.md b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_region.md index d9339dc043..3fdfd56205 100644 --- a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_region.md +++ b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_region.md @@ -92,7 +92,7 @@ This search looks for AWS provisioning activities from previously unseen regions -#### Search +#### Search ``` `cloudtrail` (eventName=Run* OR eventName=Create*) @@ -118,7 +118,8 @@ This search looks for AWS provisioning activities from previously unseen regions The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_cloud_provisioning_from_previously_unseen_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_cloud_provisioning_from_previously_unseen_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ This is a strictly behavioral search, so we define "false positive" slightly dif | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md b/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md index d6cf963cff..e1c053b02c 100644 --- a/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md +++ b/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md @@ -95,7 +95,7 @@ This search detects new API calls that have either never been seen before or tha -#### Search +#### Search ``` `cloudtrail` eventType=AwsApiCall errorCode=success userIdentity.type=AssumedRole [search `cloudtrail` eventType=AwsApiCall errorCode=success userIdentity.type=AssumedRole @@ -120,7 +120,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **detect_new_api_calls_from_user_roles_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_new_api_calls_from_user_roles_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -155,6 +156,9 @@ It is possible that there are legitimate user roles making new or infrequently u | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md index a9c3cfc081..72d96888b4 100644 --- a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md +++ b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md @@ -97,7 +97,7 @@ This search will detect users creating spikes in API activity related to securit -#### Search +#### Search ``` `cloudtrail` `security_group_api_calls` [search `cloudtrail` `security_group_api_calls` @@ -127,7 +127,8 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_group_api_calls](https://github.com/splunk/security_content/blob/develop/macros/security_group_api_calls.yml) -Note that **detect_spike_in_security_group_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_spike_in_security_group_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -159,6 +160,9 @@ Based on the values of`dataPointThreshold` and `deviationThreshold`, the false p | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md index 290c3c38aa..735784bf2f 100644 --- a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md +++ b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md @@ -12,7 +12,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -89,7 +89,7 @@ This search will detect spike in blocked outbound network connections originatin -#### Search +#### Search ``` `cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) [search `cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) @@ -115,7 +115,8 @@ This search will detect spike in blocked outbound network connections originatin The SPL above uses the following Macros: * [cloudwatchlogs_vpcflow](https://github.com/splunk/security_content/blob/develop/macros/cloudwatchlogs_vpcflow.yml) -Note that **detect_spike_in_blocked_outbound_traffic_from_your_aws_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_spike_in_blocked_outbound_traffic_from_your_aws_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -151,6 +152,9 @@ The false-positive rate may vary based on the values of`dataPointThreshold` and | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md b/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md index 8e20218a84..41584feb4e 100644 --- a/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md +++ b/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md @@ -85,7 +85,7 @@ This search looks for AWS CloudTrail events where a user logged into the AWS acc -#### Search +#### Search ``` `cloudtrail` userIdentity.sessionContext.attributes.mfaAuthenticated=false @@ -104,7 +104,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **detect_api_activity_from_users_without_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_api_activity_from_users_without_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -145,6 +146,9 @@ Many service accounts configured within an AWS infrastructure do not have multi | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md b/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md index d8ac0b5de4..4fb2b09c54 100644 --- a/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md +++ b/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md @@ -95,7 +95,7 @@ This search will detect users creating spikes in API activity related to network -#### Search +#### Search ``` `cloudtrail` `network_acl_events` [search `cloudtrail` `network_acl_events` @@ -122,10 +122,11 @@ This search will detect users creating spikes in API activity related to network #### Macros The SPL above uses the following Macros: -* [network_acl_events](https://github.com/splunk/security_content/blob/develop/macros/network_acl_events.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [network_acl_events](https://github.com/splunk/security_content/blob/develop/macros/network_acl_events.yml) -Note that **detect_spike_in_network_acl_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_spike_in_network_acl_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -157,6 +158,9 @@ The false-positive rate may vary based on the values of`dataPointThreshold` and | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md index d3daea387d..84066b6ce9 100644 --- a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md +++ b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md @@ -16,7 +16,7 @@ tags: - Network_Traffic --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -96,7 +96,7 @@ This search looks for outbound ICMP packets with a packet size larger than 1,000 -#### Search +#### Search ``` @@ -113,7 +113,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_large_outbound_icmp_packets_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_large_outbound_icmp_packets_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ ICMP packets are used in a variety of ways to help troubleshoot networking issue | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2018-06-14-splunk_enterprise_information_disclosure.md b/docs/_posts/2018-06-14-splunk_enterprise_information_disclosure.md index 36f19ecc5c..216b51191a 100644 --- a/docs/_posts/2018-06-14-splunk_enterprise_information_disclosure.md +++ b/docs/_posts/2018-06-14-splunk_enterprise_information_disclosure.md @@ -96,7 +96,7 @@ This search allows you to look for evidence of exploitation for CVE-2018-11409, -#### Search +#### Search ``` index=_internal sourcetype=splunkd_ui_access server-info @@ -112,7 +112,8 @@ index=_internal sourcetype=splunkd_ui_access server-info The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **splunk_enterprise_information_disclosure_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **splunk_enterprise_information_disclosure_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ Retrieving server information may be a legitimate API request. Verify that the a | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md index b802d19cea..d99e72cce4 100644 --- a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md +++ b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md @@ -15,7 +15,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -97,7 +97,7 @@ This search looks at S3 bucket-access logs and detects new or previously unseen -#### Search +#### Search ``` `aws_s3_accesslogs` http_status=200 [search `aws_s3_accesslogs` http_status=200 @@ -118,10 +118,11 @@ This search looks at S3 bucket-access logs and detects new or previously unseen #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [aws_s3_accesslogs](https://github.com/splunk/security_content/blob/develop/macros/aws_s3_accesslogs.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **detect_s3_access_from_a_new_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_s3_access_from_a_new_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ S3 buckets can be accessed from any IP, as long as it can make a successful conn | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2018-10-08-web_fraud_-_account_harvesting.md b/docs/_posts/2018-10-08-web_fraud_-_account_harvesting.md index 9cb23524f7..b5c9a2fccf 100644 --- a/docs/_posts/2018-10-08-web_fraud_-_account_harvesting.md +++ b/docs/_posts/2018-10-08-web_fraud_-_account_harvesting.md @@ -93,7 +93,7 @@ This search is used to identify the creation of multiple user accounts using the -#### Search +#### Search ``` `stream_http` http_content_type=text* uri="/magento2/customer/account/loginPost/" @@ -111,7 +111,8 @@ This search is used to identify the creation of multiple user accounts using the The SPL above uses the following Macros: * [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) -Note that **web_fraud_-_account_harvesting_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **web_fraud_-_account_harvesting_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ As is common with many fraud-related searches, we are usually looking to attribu | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://splunkbase.splunk.com/app/2734/](https://splunkbase.splunk.com/app/2734/) diff --git a/docs/_posts/2018-10-08-web_fraud_-_anomalous_user_clickspeed.md b/docs/_posts/2018-10-08-web_fraud_-_anomalous_user_clickspeed.md index a3b84444c3..b3d33ca219 100644 --- a/docs/_posts/2018-10-08-web_fraud_-_anomalous_user_clickspeed.md +++ b/docs/_posts/2018-10-08-web_fraud_-_anomalous_user_clickspeed.md @@ -96,7 +96,7 @@ This search is used to examine web sessions to identify those where the clicks a -#### Search +#### Search ``` `stream_http` http_content_type=text* @@ -112,7 +112,8 @@ This search is used to examine web sessions to identify those where the clicks a The SPL above uses the following Macros: * [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) -Note that **web_fraud_-_anomalous_user_clickspeed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **web_fraud_-_anomalous_user_clickspeed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ As is common with many fraud-related searches, we are usually looking to attribu | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://en.wikipedia.org/wiki/Session_ID](https://en.wikipedia.org/wiki/Session_ID) diff --git a/docs/_posts/2018-10-08-web_fraud_-_password_sharing_across_accounts.md b/docs/_posts/2018-10-08-web_fraud_-_password_sharing_across_accounts.md index 4ab7beca0e..04c1965c45 100644 --- a/docs/_posts/2018-10-08-web_fraud_-_password_sharing_across_accounts.md +++ b/docs/_posts/2018-10-08-web_fraud_-_password_sharing_across_accounts.md @@ -84,7 +84,7 @@ This search is used to identify user accounts that share a common password. -#### Search +#### Search ``` `stream_http` http_content_type=text* uri=/magento2/customer/account/loginPost* @@ -101,7 +101,8 @@ This search is used to identify user accounts that share a common password. The SPL above uses the following Macros: * [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) -Note that **web_fraud_-_password_sharing_across_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **web_fraud_-_password_sharing_across_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -128,6 +129,9 @@ As is common with many fraud-related searches, we are usually looking to attribu | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://en.wikipedia.org/wiki/Session_ID](https://en.wikipedia.org/wiki/Session_ID) diff --git a/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md b/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md index 8df41e8ffc..95a541b095 100644 --- a/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md +++ b/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md @@ -85,7 +85,7 @@ This search looks for cloud compute instances being created with previously unse -#### Search +#### Search ``` @@ -107,7 +107,8 @@ This search looks for cloud compute instances being created with previously unse The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **cloud_compute_instance_created_with_previously_unseen_image_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **cloud_compute_instance_created_with_previously_unseen_image_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -141,6 +142,9 @@ After a new image is created, the first systems created with that image will cau | 36.0 | 60 | 60 | User $user$ is creating an instance $dest$ with an image that has not been previously seen. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md index 0c62eff70b..4ffc4b8799 100644 --- a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md @@ -15,7 +15,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -98,7 +98,7 @@ This search looks for the creation of WMI permanent event subscriptions. -#### Search +#### Search ``` `wmi` EventCode=5861 Binding @@ -117,7 +117,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml) -Note that **wmi_permanent_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **wmi_permanent_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ Although unlikely, administrators may use event subscriptions for legitimate pur | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md index 0961c07a10..fd90259c62 100644 --- a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md @@ -15,7 +15,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -98,7 +98,7 @@ This search looks for the creation of WMI temporary event subscriptions. -#### Search +#### Search ``` `wmi` EventCode=5860 Temporary @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml) -Note that **wmi_temporary_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **wmi_temporary_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ Some software may create WMI temporary event subscriptions for various purposes. | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2018-11-02-windows_hosts_file_modification.md b/docs/_posts/2018-11-02-windows_hosts_file_modification.md index 3fa7ef54f4..6d10464fa3 100644 --- a/docs/_posts/2018-11-02-windows_hosts_file_modification.md +++ b/docs/_posts/2018-11-02-windows_hosts_file_modification.md @@ -90,7 +90,7 @@ The search looks for modifications to the hosts file on all Windows endpoints ac -#### Search +#### Search ``` @@ -107,7 +107,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_hosts_file_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_hosts_file_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,6 +133,9 @@ There may be legitimate reasons for system administrators to add entries to this | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md index 698f897b2e..eb46bfa48a 100644 --- a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md +++ b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md @@ -15,7 +15,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -96,7 +96,7 @@ This search detects users creating spikes in API activity related to deletion of -#### Search +#### Search ``` `cloudtrail` eventName=DeleteBucket [search `cloudtrail` eventName=DeleteBucket @@ -126,7 +126,8 @@ This search detects users creating spikes in API activity related to deletion of The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **detect_spike_in_s3_bucket_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_spike_in_s3_bucket_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -159,6 +160,9 @@ Based on the values of`dataPointThreshold` and `deviationThreshold`, the false p | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md index 76d5cffe0f..9c4607f3dc 100644 --- a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md +++ b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md @@ -97,7 +97,7 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote -#### Search +#### Search ``` @@ -114,7 +114,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **remote_wmi_command_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **remote_wmi_command_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ Administrators may use this legitimately to gather info from remote systems. Fil | 36.0 | 60 | 60 | A wmic.exe process $process$ contain node commandline $process$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.yaml](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.yaml) diff --git a/docs/_posts/2018-12-03-usn_journal_deletion.md b/docs/_posts/2018-12-03-usn_journal_deletion.md index 90f0dcf470..6d85fb0f21 100644 --- a/docs/_posts/2018-12-03-usn_journal_deletion.md +++ b/docs/_posts/2018-12-03-usn_journal_deletion.md @@ -99,7 +99,7 @@ The fsutil.exe application is a legitimate Windows utility used to perform tasks -#### Search +#### Search ``` @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **usn_journal_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **usn_journal_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,6 +149,9 @@ None identified | 45.0 | 50 | 90 | Possible USN journal deletion on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2018-12-06-suspicious_java_classes.md b/docs/_posts/2018-12-06-suspicious_java_classes.md index f62efb68cb..8bc58e37c6 100644 --- a/docs/_posts/2018-12-06-suspicious_java_classes.md +++ b/docs/_posts/2018-12-06-suspicious_java_classes.md @@ -12,7 +12,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -87,7 +87,7 @@ This search looks for suspicious Java classes that are often used to exploit rem -#### Search +#### Search ``` `stream_http` http_method=POST http_content_length>1 @@ -102,10 +102,11 @@ This search looks for suspicious Java classes that are often used to exploit rem #### Macros The SPL above uses the following Macros: -* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) -Note that **suspicious_java_classes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_java_classes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ There are no known false positives. | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2018-12-14-file_with_samsam_extension.md b/docs/_posts/2018-12-14-file_with_samsam_extension.md index 1eac74f302..48a9377b10 100644 --- a/docs/_posts/2018-12-14-file_with_samsam_extension.md +++ b/docs/_posts/2018-12-14-file_with_samsam_extension.md @@ -86,7 +86,7 @@ The search looks for file writes with extensions consistent with a SamSam ransom -#### Search +#### Search ``` @@ -104,7 +104,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **file_with_samsam_extension_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **file_with_samsam_extension_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,6 +134,9 @@ Because these extensions are not typically used in normal operations, you should | 90.0 | 100 | 90 | File writes $file_name$ with extensions consistent with a SamSam ransomware attack seen on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2018-12-14-samsam_test_file_write.md b/docs/_posts/2018-12-14-samsam_test_file_write.md index e2d89f5fb6..73f64823dc 100644 --- a/docs/_posts/2018-12-14-samsam_test_file_write.md +++ b/docs/_posts/2018-12-14-samsam_test_file_write.md @@ -94,7 +94,7 @@ The search looks for a file named "test.txt" written to the windows system direc -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **samsam_test_file_write_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **samsam_test_file_write_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ No false positives have been identified. | 12.0 | 60 | 20 | A samsam ransomware test file creation in $file_path$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md index e7d3ef011d..fca4d99e35 100644 --- a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md +++ b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md @@ -12,7 +12,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -87,7 +87,7 @@ This search looks for processes in an MacOS system that is tapping keyboard even -#### Search +#### Search ``` @@ -102,7 +102,8 @@ This search looks for processes in an MacOS system that is tapping keyboard even #### Macros The SPL above uses the following Macros: -Note that **processes_tapping_keyboard_events_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **processes_tapping_keyboard_events_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,6 +134,9 @@ There might be some false positives as keyboard event taps are used by processes | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2019-01-29-osquery_pack_-_coldroot_detection.md b/docs/_posts/2019-01-29-osquery_pack_-_coldroot_detection.md index 6daf98c953..294d6615ee 100644 --- a/docs/_posts/2019-01-29-osquery_pack_-_coldroot_detection.md +++ b/docs/_posts/2019-01-29-osquery_pack_-_coldroot_detection.md @@ -88,7 +88,7 @@ This search looks for ColdRoot events from the osx-attacks osquery pack. -#### Search +#### Search ``` @@ -103,7 +103,8 @@ This search looks for ColdRoot events from the osx-attacks osquery pack. #### Macros The SPL above uses the following Macros: -Note that **osquery_pack_-_coldroot_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **osquery_pack_-_coldroot_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -128,6 +129,9 @@ There are no known false positives. | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md b/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md index 29dff9f294..7e56579146 100644 --- a/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md +++ b/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md @@ -96,7 +96,7 @@ This search looks for PowerShell requesting privileges consistent with credentia -#### Search +#### Search ``` `wineventlog_security` signature_id=4703 Process_Name=*powershell.exe @@ -112,10 +112,11 @@ This search looks for PowerShell requesting privileges consistent with credentia #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **detect_mimikatz_via_powershell_and_eventcode_4703_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_mimikatz_via_powershell_and_eventcode_4703_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ The activity may be legitimate. PowerShell is often used by administrators to pe | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md b/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md index cbafd26337..2958197b58 100644 --- a/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md +++ b/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md @@ -93,7 +93,7 @@ The search looks for command-line arguments used to hide a file or directory usi -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **reg_exe_used_to_hide_files_directories_via_registry_keys_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **reg_exe_used_to_hide_files_directories_via_registry_keys_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ None at the moment | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md index dfb130d491..76cb358237 100644 --- a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md +++ b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md @@ -16,7 +16,7 @@ tags: - Endpoint --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -95,7 +95,7 @@ This search looks for suspicious processes on all systems labeled as web servers -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **web_servers_executing_suspicious_processes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **web_servers_executing_suspicious_processes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ Some of these processes may be used legitimately on web servers during maintenan | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2019-04-25-suspicious_file_write.md b/docs/_posts/2019-04-25-suspicious_file_write.md index ce5b24601a..ab0f3c280d 100644 --- a/docs/_posts/2019-04-25-suspicious_file_write.md +++ b/docs/_posts/2019-04-25-suspicious_file_write.md @@ -85,7 +85,7 @@ The search looks for files created with names that have been linked to malicious -#### Search +#### Search ``` @@ -100,10 +100,11 @@ The search looks for files created with names that have been linked to malicious #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml) -Note that **suspicious_file_write_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_file_write_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -128,6 +129,9 @@ It's possible for a legitimate file to be created with the same name as one note | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md index 27d65025fd..35ce40e363 100644 --- a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md +++ b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md @@ -12,7 +12,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -87,7 +87,7 @@ Command lines that are extremely long may be indicative of malicious activity on -#### Search +#### Search ``` @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **unusually_long_command_line_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **unusually_long_command_line_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ Some legitimate applications use long command lines for installs or updates. You | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md index 870eaaa73b..889de5619f 100644 --- a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md +++ b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md @@ -88,7 +88,7 @@ This search looks for applications on the endpoint that you have marked as prohi -#### Search +#### Search ``` @@ -106,7 +106,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [prohibited_softwares](https://github.com/splunk/security_content/blob/develop/macros/prohibited_softwares.yml) -Note that **prohibited_software_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **prohibited_software_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _times @@ -133,6 +134,9 @@ None identified | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md index 394b56a162..74303a6b39 100644 --- a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md +++ b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md @@ -101,7 +101,7 @@ This search looks for reading lsass memory consistent with credential dumping. -#### Search +#### Search ``` `sysmon` EventCode=10 TargetImage=*lsass.exe (GrantedAccess=0x1010 OR GrantedAccess=0x1410) @@ -117,7 +117,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **detect_credential_dumping_through_lsass_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_credential_dumping_through_lsass_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ The activity may be legitimate. Other tools can access lsass for legitimate reas | 80.0 | 80 | 100 | The $source_image$ has attempted access to read $TargetImage$ was identified on endpoint $Computer$, this is indicative of credential dumping and should be investigated. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md index d4e9c278bf..7939709a4a 100644 --- a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md +++ b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md @@ -99,7 +99,7 @@ This search looks for reading loaded Images unique to credential dumping with Mi -#### Search +#### Search ``` `sysmon` EventCode=7 @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **detect_mimikatz_using_loaded_images_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_mimikatz_using_loaded_images_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ Other tools can import the same DLLs. These tools should be part of a whitelist. | 64.0 | 80 | 80 | A process, $Image$, has loaded $ImageLoaded$ that are typically related to credential dumping on $Computer$. Review for further details. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html](https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html) diff --git a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md index 1207045581..ae1bfd429b 100644 --- a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md +++ b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md @@ -98,7 +98,7 @@ Detect memory dumping of the LSASS process. -#### Search +#### Search ``` `sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll* @@ -114,7 +114,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **access_lsass_memory_for_dump_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **access_lsass_memory_for_dump_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ Administrators can create memory dumps for debugging purposes, but memory dumps | 63.0 | 70 | 90 | process $SourceImage$ injected into $TargetImage$ and was attempted dump LSASS on $dest$. Adversaries tend to do this when trying to accesss credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf](https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf) diff --git a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md index 8e7e2a8e39..e92bf175f0 100644 --- a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md +++ b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md @@ -98,7 +98,7 @@ Detect remote thread creation into LSASS consistent with credential dumping. -#### Search +#### Search ``` `sysmon` EventID=8 TargetImage=*lsass.exe @@ -114,7 +114,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **create_remote_thread_into_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **create_remote_thread_into_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ Other tools can access LSASS for legitimate reasons and generate an event. In th | 81.0 | 90 | 90 | A process has created a remote thread into $TargetImage$ on $dest$. This behavior is indicative of credential dumping and should be investigated. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf](https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf) diff --git a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md index 22d3f1e368..25227fec59 100644 --- a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md +++ b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md @@ -93,7 +93,7 @@ This search detects loading of unsigned images by LSASS. Deprecated because too -#### Search +#### Search ``` `sysmon` EventID=7 Image=*lsass.exe Signed=false @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **unsigned_image_loaded_by_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **unsigned_image_loaded_by_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,6 +135,9 @@ Other tools could load images into LSASS for legitimate reason. But enterprise t | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf](https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf) diff --git a/docs/_posts/2019-12-10-creation_of_shadow_copy.md b/docs/_posts/2019-12-10-creation_of_shadow_copy.md index c88ba93d1b..a07090a2a0 100644 --- a/docs/_posts/2019-12-10-creation_of_shadow_copy.md +++ b/docs/_posts/2019-12-10-creation_of_shadow_copy.md @@ -99,7 +99,7 @@ Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy. -#### Search +#### Search ``` @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **creation_of_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **creation_of_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ Legitimate administrator usage of Vssadmin or Wmic will create false positives. | 81.0 | 90 | 90 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf](https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf) diff --git a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md index f6f9c8087e..754ebd0944 100644 --- a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md +++ b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md @@ -19,7 +19,7 @@ tags: - Network_Resolution --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -103,7 +103,7 @@ This search allows you to identify DNS requests that are unusually large for the -#### Search +#### Search ``` @@ -126,7 +126,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **dns_query_length_outliers_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **dns_query_length_outliers_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -163,6 +164,9 @@ If you are seeing more results than desired, you may consider reducing the value | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md b/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md index 2d35a4e8a9..21dd883b58 100644 --- a/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md +++ b/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md @@ -94,7 +94,7 @@ this search is to detect a suspicious registry modification to implement auto ad -#### Search +#### Search ``` @@ -114,7 +114,8 @@ this search is to detect a suspicious registry modification to implement auto ad The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **auto_admin_logon_registry_entry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **auto_admin_logon_registry_entry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ unknown | 63.0 | 70 | 90 | modified registry key $registry_key_name$ with registry value $registry_value_name$ to prepare autoadminlogon | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/](https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/) diff --git a/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md b/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md index f74ab75362..ec4d2570f0 100644 --- a/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md +++ b/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md @@ -102,7 +102,7 @@ This search looks for registry activity associated with modifications to the reg -#### Search +#### Search ``` @@ -122,7 +122,8 @@ This search looks for registry activity associated with modifications to the reg The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **monitor_registry_keys_for_print_monitors_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **monitor_registry_keys_for_print_monitors_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -155,6 +156,9 @@ You will encounter noise from legitimate print-monitor registry entries. | 64.0 | 80 | 80 | New print monitor added on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md b/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md index 8616c8c08b..6c2b77b09a 100644 --- a/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md +++ b/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md @@ -100,7 +100,7 @@ This search looks for registry activity associated with application compatibilit -#### Search +#### Search ``` @@ -120,7 +120,8 @@ This search looks for registry activity associated with application compatibilit The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **registry_keys_for_creating_shim_databases_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **registry_keys_for_creating_shim_databases_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ There are many legitimate applications that leverage shim databases for compatib | 56.0 | 70 | 80 | A registry activity in $registry_path$ related to shim modication in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-01-28-sdclt_uac_bypass.md b/docs/_posts/2020-01-28-sdclt_uac_bypass.md index a9c1b96c7f..02707bb1a7 100644 --- a/docs/_posts/2020-01-28-sdclt_uac_bypass.md +++ b/docs/_posts/2020-01-28-sdclt_uac_bypass.md @@ -96,7 +96,7 @@ This search is to detect a suspicious sdclt.exe registry modification. This tech -#### Search +#### Search ``` @@ -116,7 +116,8 @@ This search is to detect a suspicious sdclt.exe registry modification. This tech The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **sdclt_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **sdclt_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ Limited to no false positives are expected. | 63.0 | 70 | 90 | Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/](https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/) diff --git a/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md b/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md index 7adaa244f8..de3cbb556a 100644 --- a/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md +++ b/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md @@ -96,7 +96,7 @@ This search is to detect a suspicious modification of registry that may related -#### Search +#### Search ``` @@ -116,7 +116,8 @@ This search is to detect a suspicious modification of registry that may related The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **silentcleanup_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **silentcleanup_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ unknown | 63.0 | 70 | 90 | Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/hfiref0x/UACME](https://github.com/hfiref0x/UACME) diff --git a/docs/_posts/2020-01-28-wsreset_uac_bypass.md b/docs/_posts/2020-01-28-wsreset_uac_bypass.md index f7ddb6e77c..58923fe59a 100644 --- a/docs/_posts/2020-01-28-wsreset_uac_bypass.md +++ b/docs/_posts/2020-01-28-wsreset_uac_bypass.md @@ -96,7 +96,7 @@ This search is to detect a suspicious modification of registry related to UAC by -#### Search +#### Search ``` @@ -116,7 +116,8 @@ This search is to detect a suspicious modification of registry related to UAC by The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **wsreset_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **wsreset_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ unknown | 63.0 | 70 | 90 | Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/hfiref0x/UACME](https://github.com/hfiref0x/UACME) diff --git a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md index d98160f92d..4eaaefea8a 100644 --- a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md +++ b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md @@ -98,7 +98,7 @@ Detect the hands on keyboard behavior of Windows Task Manager creating a process -#### Search +#### Search ``` `sysmon` EventID=11 process_name=taskmgr.exe TargetFilename=*lsass*.dmp @@ -114,7 +114,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **creation_of_lsass_dump_with_taskmgr_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **creation_of_lsass_dump_with_taskmgr_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ Administrators can create memory dumps for debugging purposes, but memory dumps | 80.0 | 80 | 100 | $process_name$ was identified on endpoint $Computer$ writing $TargetFilename$ to disk. This behavior is related to dumping credentials via Task Manager. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-5---dump-lsassexe-memory-using-windows-task-manager](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-5---dump-lsassexe-memory-using-windows-task-manager) diff --git a/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md b/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md index 401f6ccd76..1efdf25260 100644 --- a/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md +++ b/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md @@ -84,7 +84,7 @@ This search looks for EC2 instances being created with previously unseen instanc -#### Search +#### Search ``` `cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunInstances errorCode=success @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **ec2_instance_started_with_previously_unseen_instance_type_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **ec2_instance_started_with_previously_unseen_instance_type_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ It is possible that an admin will create a new system using a new instance type | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md index 39680d038f..fe8d0cdca2 100644 --- a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md +++ b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md @@ -13,7 +13,7 @@ tags: - Endpoint --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -89,7 +89,7 @@ This search looks for processes referencing the plist files that determine which -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **macos_-_re-opened_applications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **macos_-_re-opened_applications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,6 +137,9 @@ At this stage, there are no known false positives. During testing, no process ev | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-02-20-gcp_gcr_container_uploaded.md b/docs/_posts/2020-02-20-gcp_gcr_container_uploaded.md index 5170d9732c..d9a4c0ab42 100644 --- a/docs/_posts/2020-02-20-gcp_gcr_container_uploaded.md +++ b/docs/_posts/2020-02-20-gcp_gcr_container_uploaded.md @@ -88,7 +88,7 @@ This search show information on uploaded containers including source user, accou -#### Search +#### Search ``` @@ -100,7 +100,8 @@ This search show information on uploaded containers including source user, accou #### Macros The SPL above uses the following Macros: -Note that **gcp_gcr_container_uploaded_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **gcp_gcr_container_uploaded_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -125,6 +126,9 @@ Uploading container is a normal behavior from developers or users with access to | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md index dcce7c2a47..62bba30526 100644 --- a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md +++ b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md @@ -15,7 +15,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -90,7 +90,7 @@ This searches show information on uploaded containers including source user, ima -#### Search +#### Search ``` @@ -102,7 +102,8 @@ This searches show information on uploaded containers including source user, ima #### Macros The SPL above uses the following Macros: -Note that **new_container_uploaded_to_aws_ecr_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **new_container_uploaded_to_aws_ecr_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -127,6 +128,9 @@ Uploading container is a normal behavior from developers or users with access to | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md index eec5b83dd5..c94ba3167b 100644 --- a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md +++ b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md @@ -100,7 +100,7 @@ Detect the usage of comsvcs.dll for dumping the lsass process. -#### Search +#### Search ``` @@ -113,11 +113,12 @@ Detect the usage of comsvcs.dll for dumping the lsass process. #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -Note that **dump_lsass_via_comsvcs_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **dump_lsass_via_comsvcs_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -157,6 +158,9 @@ None identified. | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified accessing credentials using comsvcs.dll on endpoint $dest$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/](https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/) diff --git a/docs/_posts/2020-03-02-remote_registry_key_modifications.md b/docs/_posts/2020-03-02-remote_registry_key_modifications.md index 4eeb6dc2fa..c9762e2b1a 100644 --- a/docs/_posts/2020-03-02-remote_registry_key_modifications.md +++ b/docs/_posts/2020-03-02-remote_registry_key_modifications.md @@ -85,7 +85,7 @@ This search monitors for remote modifications to registry keys. -#### Search +#### Search ``` @@ -101,7 +101,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **remote_registry_key_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **remote_registry_key_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -128,6 +129,9 @@ This technique may be legitimately used by administrators to modify remote regis | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md index bc283bcb2d..2ee83ab29c 100644 --- a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md +++ b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md @@ -17,7 +17,7 @@ tags: - Endpoint --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -103,7 +103,7 @@ This search looks for child processes of spoolsv.exe. This activity is associate -#### Search +#### Search ``` @@ -119,7 +119,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **child_processes_of_spoolsv_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **child_processes_of_spoolsv_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,6 +153,9 @@ Some legitimate printer-related processes may show up as children of spoolsv.exe | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-03-16-detect_rare_executables.md b/docs/_posts/2020-03-16-detect_rare_executables.md index 98813317e6..c334916b0c 100644 --- a/docs/_posts/2020-03-16-detect_rare_executables.md +++ b/docs/_posts/2020-03-16-detect_rare_executables.md @@ -13,7 +13,7 @@ tags: - Endpoint --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -93,7 +93,7 @@ This search will return a table of rare processes, the names of the systems runn -#### Search +#### Search ``` @@ -113,11 +113,12 @@ This search will return a table of rare processes, the names of the systems runn #### Macros The SPL above uses the following Macros: -* [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_rare_executables_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_rare_executables_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ Some legitimate processes may be only rarely executed in your environment. As th | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-03-16-process_execution_via_wmi.md b/docs/_posts/2020-03-16-process_execution_via_wmi.md index 5bb42c46c5..504f03412c 100644 --- a/docs/_posts/2020-03-16-process_execution_via_wmi.md +++ b/docs/_posts/2020-03-16-process_execution_via_wmi.md @@ -97,7 +97,7 @@ The following analytic identifies `WmiPrvSE.exe` spawning a process. This typica -#### Search +#### Search ``` @@ -113,7 +113,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **process_execution_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **process_execution_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ Although unlikely, administrators may use wmi to execute commands for legitimate | 49.0 | 70 | 70 | A remote instance execution of wmic.exe that will spawn $parent_process_name$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-03-16-script_execution_via_wmi.md b/docs/_posts/2020-03-16-script_execution_via_wmi.md index 646a2beb74..302155c2f8 100644 --- a/docs/_posts/2020-03-16-script_execution_via_wmi.md +++ b/docs/_posts/2020-03-16-script_execution_via_wmi.md @@ -97,7 +97,7 @@ This search looks for scripts launched via WMI. -#### Search +#### Search ``` @@ -113,7 +113,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **script_execution_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **script_execution_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ Although unlikely, administrators may use wmi to launch scripts for legitimate p | 36.0 | 60 | 60 | A wmic.exe process $process_name$ taht execute script in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://redcanary.com/blog/child-processes/](https://redcanary.com/blog/child-processes/) diff --git a/docs/_posts/2020-03-16-spike_in_file_writes.md b/docs/_posts/2020-03-16-spike_in_file_writes.md index 419e63d1db..72c8616da9 100644 --- a/docs/_posts/2020-03-16-spike_in_file_writes.md +++ b/docs/_posts/2020-03-16-spike_in_file_writes.md @@ -12,7 +12,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -86,7 +86,7 @@ The search looks for a sharp increase in the number of files written to a partic -#### Search +#### Search ``` @@ -103,7 +103,8 @@ The search looks for a sharp increase in the number of files written to a partic The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **spike_in_file_writes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **spike_in_file_writes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,6 +133,9 @@ It is important to understand that if you happen to install any new applications | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md index b4a7fa53a5..f2accc3ed8 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md @@ -15,7 +15,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -90,7 +90,7 @@ This search provides information of unauthenticated requests via user agent, and -#### Search +#### Search ``` `aws_cloudwatchlogs_eks` "user.username"="system:anonymous" userAgent!="AWS Security Scanner" @@ -103,10 +103,11 @@ This search provides information of unauthenticated requests via user agent, and #### Macros The SPL above uses the following Macros: -* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) -Note that **amazon_eks_kubernetes_cluster_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **amazon_eks_kubernetes_cluster_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ Not all unauthenticated requests are malicious, but frequency, UA and source IPs | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md index 15b4c886d9..1a41c9546a 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md @@ -15,7 +15,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -90,7 +90,7 @@ This search provides detection information on unauthenticated requests against K -#### Search +#### Search ``` `aws_cloudwatchlogs_eks` "user.username"="system:anonymous" verb=list objectRef.resource=pods requestURI="/api/v1/pods" @@ -103,10 +103,11 @@ This search provides detection information on unauthenticated requests against K #### Macros The SPL above uses the following Macros: -* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) -Note that **amazon_eks_kubernetes_pod_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **amazon_eks_kubernetes_pod_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ Not all unauthenticated requests are malicious, but frequency, UA and source IPs | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md index ea8127f018..a90fe76924 100644 --- a/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md +++ b/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md @@ -88,7 +88,7 @@ This search provides information of unauthenticated requests via user agent, and -#### Search +#### Search ``` `google_gcp_pubsub_message` data.protoPayload.requestMetadata.callerIp!=127.0.0.1 data.protoPayload.requestMetadata.callerIp!=::1 "data.labels.authorization.k8s.io/decision"=forbid "data.protoPayload.status.message"=PERMISSION_DENIED data.protoPayload.authenticationInfo.principalEmail="system:anonymous" @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that **gcp_kubernetes_cluster_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **gcp_kubernetes_cluster_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -130,6 +131,9 @@ Not all unauthenticated requests are malicious, but frequency, User Agent and so | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-05-19-kubernetes_azure_scan_fingerprint.md b/docs/_posts/2020-05-19-kubernetes_azure_scan_fingerprint.md index 85ddc035a9..e53d774e00 100644 --- a/docs/_posts/2020-05-19-kubernetes_azure_scan_fingerprint.md +++ b/docs/_posts/2020-05-19-kubernetes_azure_scan_fingerprint.md @@ -88,7 +88,7 @@ This search provides information of unauthenticated requests via source IP user -#### Search +#### Search ``` `kubernetes_azure` category=kube-audit @@ -102,7 +102,8 @@ This search provides information of unauthenticated requests via source IP user The SPL above uses the following Macros: * [kubernetes_azure](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_azure.yml) -Note that **kubernetes_azure_scan_fingerprint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kubernetes_azure_scan_fingerprint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -127,6 +128,9 @@ Not all unauthenticated requests are malicious, but source IPs, userAgent, verb, | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md index 34bfcf4a04..a59eed5e9e 100644 --- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md +++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md @@ -16,7 +16,7 @@ tags: - Endpoint --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -98,7 +98,7 @@ This search looks for child processes spawned by zoom.exe or zoom.us that has no -#### Search +#### Search ``` @@ -117,7 +117,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [previously_seen_zoom_child_processes_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_zoom_child_processes_window.yml) -Note that **first_time_seen_child_process_of_zoom_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **first_time_seen_child_process_of_zoom_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -154,6 +155,9 @@ A new child process of zoom isn't malicious by that fact alone. Further investig | 64.0 | 80 | 80 | Child process $process_name$ with $process_id$ spawned by zoom.exe or zoom.us which has not been previously on host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_object_access.md b/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_object_access.md index efec8bdfac..2d7608091c 100644 --- a/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_object_access.md +++ b/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_object_access.md @@ -80,7 +80,7 @@ This search provides information on Kubernetes accounts accessing sensitve objec -#### Search +#### Search ``` `kubernetes_azure` category=kube-audit @@ -95,7 +95,8 @@ This search provides information on Kubernetes accounts accessing sensitve objec The SPL above uses the following Macros: * [kubernetes_azure](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_azure.yml) -Note that **kubernetes_azure_detect_sensitive_object_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kubernetes_azure_detect_sensitive_object_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -120,6 +121,9 @@ Sensitive object access is not necessarily malicious but user and object context | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_role_access.md b/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_role_access.md index 205b8587bc..b1aaeaecc1 100644 --- a/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_role_access.md +++ b/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_role_access.md @@ -80,7 +80,7 @@ This search provides information on Kubernetes accounts accessing sensitve objec -#### Search +#### Search ``` `kubernetes_azure` category=kube-audit @@ -95,7 +95,8 @@ This search provides information on Kubernetes accounts accessing sensitve objec The SPL above uses the following Macros: * [kubernetes_azure](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_azure.yml) -Note that **kubernetes_azure_detect_sensitive_role_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kubernetes_azure_detect_sensitive_role_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -120,6 +121,9 @@ Sensitive role resource access is necessary for cluster operation, however sourc | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-05-20-kubernetes_azure_detect_service_accounts_forbidden_failure_access.md b/docs/_posts/2020-05-20-kubernetes_azure_detect_service_accounts_forbidden_failure_access.md index 51793bf49d..0477e1aeb6 100644 --- a/docs/_posts/2020-05-20-kubernetes_azure_detect_service_accounts_forbidden_failure_access.md +++ b/docs/_posts/2020-05-20-kubernetes_azure_detect_service_accounts_forbidden_failure_access.md @@ -80,7 +80,7 @@ This search provides information on Kubernetes service accounts with failure or -#### Search +#### Search ``` `kubernetes_azure` category=kube-audit @@ -94,7 +94,8 @@ This search provides information on Kubernetes service accounts with failure or The SPL above uses the following Macros: * [kubernetes_azure](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_azure.yml) -Note that **kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -119,6 +120,9 @@ This search can give false positives as there might be inherent issues with auth | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-05-20-kubernetes_azure_pod_scan_fingerprint.md b/docs/_posts/2020-05-20-kubernetes_azure_pod_scan_fingerprint.md index e6b077a9a1..8864562f5d 100644 --- a/docs/_posts/2020-05-20-kubernetes_azure_pod_scan_fingerprint.md +++ b/docs/_posts/2020-05-20-kubernetes_azure_pod_scan_fingerprint.md @@ -80,7 +80,7 @@ This search provides information of unauthenticated requests via source IP user -#### Search +#### Search ``` `kubernetes_azure` category=kube-audit @@ -94,7 +94,8 @@ This search provides information of unauthenticated requests via source IP user The SPL above uses the following Macros: * [kubernetes_azure](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_azure.yml) -Note that **kubernetes_azure_pod_scan_fingerprint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kubernetes_azure_pod_scan_fingerprint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -119,6 +120,9 @@ Not all unauthenticated requests are malicious, but source IPs, userAgent, verb, | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-05-26-kubernetes_azure_active_service_accounts_by_pod_namespace.md b/docs/_posts/2020-05-26-kubernetes_azure_active_service_accounts_by_pod_namespace.md index 6d0fd77c18..c8fcdf8b74 100644 --- a/docs/_posts/2020-05-26-kubernetes_azure_active_service_accounts_by_pod_namespace.md +++ b/docs/_posts/2020-05-26-kubernetes_azure_active_service_accounts_by_pod_namespace.md @@ -80,7 +80,7 @@ This search provides information on Kubernetes service accounts,accessing pods a -#### Search +#### Search ``` `kubernetes_azure` category=kube-audit @@ -95,7 +95,8 @@ This search provides information on Kubernetes service accounts,accessing pods a The SPL above uses the following Macros: * [kubernetes_azure](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_azure.yml) -Note that **kubernetes_azure_active_service_accounts_by_pod_namespace_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kubernetes_azure_active_service_accounts_by_pod_namespace_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -120,6 +121,9 @@ Not all service accounts interactions are malicious. Analyst must consider IP an | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-05-26-kubernetes_azure_detect_rbac_authorization_by_account.md b/docs/_posts/2020-05-26-kubernetes_azure_detect_rbac_authorization_by_account.md index f9bad36585..8df5c22093 100644 --- a/docs/_posts/2020-05-26-kubernetes_azure_detect_rbac_authorization_by_account.md +++ b/docs/_posts/2020-05-26-kubernetes_azure_detect_rbac_authorization_by_account.md @@ -80,7 +80,7 @@ This search provides information on Kubernetes RBAC authorizations by accounts, -#### Search +#### Search ``` `kubernetes_azure` category=kube-audit @@ -96,7 +96,8 @@ This search provides information on Kubernetes RBAC authorizations by accounts, The SPL above uses the following Macros: * [kubernetes_azure](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_azure.yml) -Note that **kubernetes_azure_detect_rbac_authorization_by_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kubernetes_azure_detect_rbac_authorization_by_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -121,6 +122,9 @@ Not all RBAC Authorications are malicious. RBAC authorizations can uncover malic | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-05-26-kubernetes_azure_detect_suspicious_kubectl_calls.md b/docs/_posts/2020-05-26-kubernetes_azure_detect_suspicious_kubectl_calls.md index df0cc357c2..f724f7b4c8 100644 --- a/docs/_posts/2020-05-26-kubernetes_azure_detect_suspicious_kubectl_calls.md +++ b/docs/_posts/2020-05-26-kubernetes_azure_detect_suspicious_kubectl_calls.md @@ -80,7 +80,7 @@ This search provides information on rare Kubectl calls with IP, verb namespace a -#### Search +#### Search ``` `kubernetes_azure` category=kube-audit @@ -96,7 +96,8 @@ This search provides information on rare Kubectl calls with IP, verb namespace a The SPL above uses the following Macros: * [kubernetes_azure](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_azure.yml) -Note that **kubernetes_azure_detect_suspicious_kubectl_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kubernetes_azure_detect_suspicious_kubectl_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -121,6 +122,9 @@ Kubectl calls are not malicious by nature. However source IP, verb and Object ca | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md b/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md index 5dae9a4aba..692580fb4b 100644 --- a/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md +++ b/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md @@ -87,7 +87,7 @@ This search looks for AssumeRole events where an IAM role in a different account -#### Search +#### Search ``` @@ -108,7 +108,8 @@ This search looks for AssumeRole events where an IAM role in a different account The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **aws_cross_account_activity_from_previously_unseen_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_cross_account_activity_from_previously_unseen_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -143,6 +144,9 @@ Using multiple AWS accounts and roles is perfectly valid behavior. It's suspicio | 15.0 | 30 | 50 | AWS account $requestingAccountId$ is trying to access resource from some other account $requestedAccountId$, for the first time. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-06-23-aws_eks_kubernetes_cluster_sensitive_object_access.md b/docs/_posts/2020-06-23-aws_eks_kubernetes_cluster_sensitive_object_access.md index 80b1792a03..9221290cc0 100644 --- a/docs/_posts/2020-06-23-aws_eks_kubernetes_cluster_sensitive_object_access.md +++ b/docs/_posts/2020-06-23-aws_eks_kubernetes_cluster_sensitive_object_access.md @@ -80,7 +80,7 @@ This search provides information on Kubernetes accounts accessing sensitve objec -#### Search +#### Search ``` `aws_cloudwatchlogs_eks` objectRef.resource=secrets OR configmaps sourceIPs{}!=::1 sourceIPs{}!=127.0.0.1 @@ -93,7 +93,8 @@ This search provides information on Kubernetes accounts accessing sensitve objec The SPL above uses the following Macros: * [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) -Note that **aws_eks_kubernetes_cluster_sensitive_object_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_eks_kubernetes_cluster_sensitive_object_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -118,6 +119,9 @@ Sensitive object access is not necessarily malicious but user and object context | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_most_active_service_accounts_by_pod.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_most_active_service_accounts_by_pod.md index c66f2fea57..654633ad5d 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_most_active_service_accounts_by_pod.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_most_active_service_accounts_by_pod.md @@ -80,7 +80,7 @@ This search provides information on Kubernetes service accounts,accessing pods b -#### Search +#### Search ``` `aws_cloudwatchlogs_eks` user.groups{}=system:serviceaccounts objectRef.resource=pods @@ -93,7 +93,8 @@ This search provides information on Kubernetes service accounts,accessing pods b The SPL above uses the following Macros: * [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) -Note that **kubernetes_aws_detect_most_active_service_accounts_by_pod_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kubernetes_aws_detect_most_active_service_accounts_by_pod_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -118,6 +119,9 @@ Not all service accounts interactions are malicious. Analyst must consider IP, v | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_rbac_authorization_by_account.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_rbac_authorization_by_account.md index 832f4df40f..88267735d2 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_rbac_authorization_by_account.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_rbac_authorization_by_account.md @@ -80,7 +80,7 @@ This search provides information on Kubernetes RBAC authorizations by accounts, -#### Search +#### Search ``` `aws_cloudwatchlogs_eks` annotations.authorization.k8s.io/reason=* @@ -94,7 +94,8 @@ This search provides information on Kubernetes RBAC authorizations by accounts, The SPL above uses the following Macros: * [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) -Note that **kubernetes_aws_detect_rbac_authorization_by_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kubernetes_aws_detect_rbac_authorization_by_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -119,6 +120,9 @@ Not all RBAC Authorications are malicious. RBAC authorizations can uncover malic | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_sensitive_role_access.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_sensitive_role_access.md index ea69275131..64776ab859 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_sensitive_role_access.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_sensitive_role_access.md @@ -80,7 +80,7 @@ This search provides information on Kubernetes accounts accessing sensitve objec -#### Search +#### Search ``` `aws_cloudwatchlogs_eks` objectRef.resource=clusterroles OR clusterrolebindings sourceIPs{}!=::1 sourceIPs{}!=127.0.0.1 @@ -93,7 +93,8 @@ This search provides information on Kubernetes accounts accessing sensitve objec The SPL above uses the following Macros: * [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) -Note that **kubernetes_aws_detect_sensitive_role_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kubernetes_aws_detect_sensitive_role_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -118,6 +119,9 @@ Sensitive role resource access is necessary for cluster operation, however sourc | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_service_accounts_forbidden_failure_access.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_service_accounts_forbidden_failure_access.md index b6092e7c34..7d99f1e970 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_service_accounts_forbidden_failure_access.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_service_accounts_forbidden_failure_access.md @@ -80,7 +80,7 @@ This search provides information on Kubernetes service accounts with failure or -#### Search +#### Search ``` `aws_cloudwatchlogs_eks` user.groups{}=system:serviceaccounts responseStatus.status = Failure @@ -92,7 +92,8 @@ This search provides information on Kubernetes service accounts with failure or The SPL above uses the following Macros: * [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) -Note that **kubernetes_aws_detect_service_accounts_forbidden_failure_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kubernetes_aws_detect_service_accounts_forbidden_failure_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -117,6 +118,9 @@ This search can give false positives as there might be inherent issues with auth | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md index f3e02c754b..8d072e3de6 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md @@ -12,7 +12,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -82,7 +82,7 @@ This search provides information on anonymous Kubectl calls with IP, verb namesp -#### Search +#### Search ``` `aws_cloudwatchlogs_eks` userAgent=kubectl* sourceIPs{}!=127.0.0.1 sourceIPs{}!=::1 src_user=system:anonymous @@ -95,7 +95,8 @@ This search provides information on anonymous Kubectl calls with IP, verb namesp The SPL above uses the following Macros: * [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) -Note that **kubernetes_aws_detect_suspicious_kubectl_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kubernetes_aws_detect_suspicious_kubectl_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -126,6 +127,9 @@ Kubectl calls are not malicious by nature. However source IP, verb and Object ca | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-06-23-kubernetes_gcp_detect_service_accounts_forbidden_failure_access.md b/docs/_posts/2020-06-23-kubernetes_gcp_detect_service_accounts_forbidden_failure_access.md index 8338bae07a..160a9a0a08 100644 --- a/docs/_posts/2020-06-23-kubernetes_gcp_detect_service_accounts_forbidden_failure_access.md +++ b/docs/_posts/2020-06-23-kubernetes_gcp_detect_service_accounts_forbidden_failure_access.md @@ -80,7 +80,7 @@ This search provides information on Kubernetes service accounts with failure or -#### Search +#### Search ``` `google_gcp_pubsub_message` system:serviceaccounts data.protoPayload.response.status.allowed!=* @@ -93,7 +93,8 @@ This search provides information on Kubernetes service accounts with failure or The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that **kubernetes_gcp_detect_service_accounts_forbidden_failure_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kubernetes_gcp_detect_service_accounts_forbidden_failure_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -118,6 +119,9 @@ This search can give false positives as there might be inherent issues with auth | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md index 0b8d0fe950..9966d9fc64 100644 --- a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md +++ b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md @@ -103,7 +103,7 @@ The detection Detect Path Interception By Creation Of program exe is detecting t -#### Search +#### Search ``` @@ -126,7 +126,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_path_interception_by_creation_of_program_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_path_interception_by_creation_of_program_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -162,6 +163,9 @@ unknown | 49.0 | 70 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to perform privilege escalation by using unquoted service paths. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae](https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae) diff --git a/docs/_posts/2020-07-06-short_lived_windows_accounts.md b/docs/_posts/2020-07-06-short_lived_windows_accounts.md index 4abbe33b71..96c8cd9727 100644 --- a/docs/_posts/2020-07-06-short_lived_windows_accounts.md +++ b/docs/_posts/2020-07-06-short_lived_windows_accounts.md @@ -98,7 +98,7 @@ This search detects accounts that were created and deleted in a short time perio -#### Search +#### Search ``` @@ -117,7 +117,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **short_lived_windows_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **short_lived_windows_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ It is possible that an administrator created and deleted an account in a short t | 63.0 | 70 | 90 | A user account created or delete shortly in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-06-windows_event_log_cleared.md b/docs/_posts/2020-07-06-windows_event_log_cleared.md index 45388b18c6..57ce4494b1 100644 --- a/docs/_posts/2020-07-06-windows_event_log_cleared.md +++ b/docs/_posts/2020-07-06-windows_event_log_cleared.md @@ -103,7 +103,7 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve -#### Search +#### Search ``` (`wineventlog_security` EventCode=1102) OR (`wineventlog_system` EventCode=104) @@ -115,11 +115,12 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) -Note that **windows_event_log_cleared_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_event_log_cleared_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,6 +149,9 @@ It is possible that these logs may be legitimately cleared by Administrators. Fi | 70.0 | 70 | 100 | Windows event logs cleared on $dest$ via EventCode $EventCode$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1102](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1102) diff --git a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md index 1ae0a786ec..de86017e13 100644 --- a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md +++ b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md @@ -19,7 +19,7 @@ tags: - Network_Traffic --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -104,7 +104,7 @@ This search looks for network traffic on TCP/3389, the default port used by remo -#### Search +#### Search ``` @@ -120,7 +120,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **remote_desktop_network_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **remote_desktop_network_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -154,6 +155,9 @@ Remote Desktop may be used legitimately by users on the network. | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-08-detect_new_local_admin_account.md b/docs/_posts/2020-07-08-detect_new_local_admin_account.md index 13b59c4b4a..83fdcda467 100644 --- a/docs/_posts/2020-07-08-detect_new_local_admin_account.md +++ b/docs/_posts/2020-07-08-detect_new_local_admin_account.md @@ -99,7 +99,7 @@ This search looks for newly created accounts that have been elevated to local ad -#### Search +#### Search ``` `wineventlog_security` EventCode=4720 OR (EventCode=4732 Group_Name=Administrators) @@ -113,10 +113,11 @@ This search looks for newly created accounts that have been elevated to local ad #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **detect_new_local_admin_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_new_local_admin_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ The activity may be legitimate. For this reason, it's best to verify the account | 42.0 | 60 | 70 | A $user$ on $dest$ was added recently. Identify if this was legitimate behavior or not. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-10-kubernetes_gcp_detect_most_active_service_accounts_by_pod.md b/docs/_posts/2020-07-10-kubernetes_gcp_detect_most_active_service_accounts_by_pod.md index 724092a746..634105e751 100644 --- a/docs/_posts/2020-07-10-kubernetes_gcp_detect_most_active_service_accounts_by_pod.md +++ b/docs/_posts/2020-07-10-kubernetes_gcp_detect_most_active_service_accounts_by_pod.md @@ -80,7 +80,7 @@ This search provides information on Kubernetes service accounts,accessing pods b -#### Search +#### Search ``` `google_gcp_pubsub_message` data.protoPayload.request.spec.group{}=system:serviceaccounts @@ -93,7 +93,8 @@ This search provides information on Kubernetes service accounts,accessing pods b The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that **kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -118,6 +119,9 @@ Not all service accounts interactions are malicious. Analyst must consider IP, v | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-11-kubernetes_gcp_detect_rbac_authorizations_by_account.md b/docs/_posts/2020-07-11-kubernetes_gcp_detect_rbac_authorizations_by_account.md index fd255cc900..b3857935fb 100644 --- a/docs/_posts/2020-07-11-kubernetes_gcp_detect_rbac_authorizations_by_account.md +++ b/docs/_posts/2020-07-11-kubernetes_gcp_detect_rbac_authorizations_by_account.md @@ -80,7 +80,7 @@ This search provides information on Kubernetes RBAC authorizations by accounts, -#### Search +#### Search ``` `google_gcp_pubsub_message` data.labels.authorization.k8s.io/reason=ClusterRoleBinding OR Clusterrole @@ -93,7 +93,8 @@ This search provides information on Kubernetes RBAC authorizations by accounts, The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that **kubernetes_gcp_detect_rbac_authorizations_by_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kubernetes_gcp_detect_rbac_authorizations_by_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -118,6 +119,9 @@ Not all RBAC Authorications are malicious. RBAC authorizations can uncover malic | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_object_access.md b/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_object_access.md index c1aa580a0a..ab7b2af297 100644 --- a/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_object_access.md +++ b/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_object_access.md @@ -80,7 +80,7 @@ This search provides information on Kubernetes accounts accessing sensitve objec -#### Search +#### Search ``` `google_gcp_pubsub_message` data.protoPayload.authorizationInfo{}.resource=configmaps OR secrets @@ -93,7 +93,8 @@ This search provides information on Kubernetes accounts accessing sensitve objec The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that **kubernetes_gcp_detect_sensitive_object_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kubernetes_gcp_detect_sensitive_object_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -118,6 +119,9 @@ Sensitive object access is not necessarily malicious but user and object context | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_role_access.md b/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_role_access.md index b347ee6f4e..ed142f01b1 100644 --- a/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_role_access.md +++ b/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_role_access.md @@ -80,7 +80,7 @@ This search provides information on Kubernetes accounts accessing sensitve objec -#### Search +#### Search ``` `google_gcp_pubsub_message` data.labels.authorization.k8s.io/reason=ClusterRoleBinding OR Clusterrole dest=apis/rbac.authorization.k8s.io/v1 src_ip!=::1 @@ -93,7 +93,8 @@ This search provides information on Kubernetes accounts accessing sensitve objec The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that **kubernetes_gcp_detect_sensitive_role_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kubernetes_gcp_detect_sensitive_role_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -118,6 +119,9 @@ Sensitive role resource access is necessary for cluster operation, however sourc | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-11-kubernetes_gcp_detect_suspicious_kubectl_calls.md b/docs/_posts/2020-07-11-kubernetes_gcp_detect_suspicious_kubectl_calls.md index c29465b6be..042925f1f0 100644 --- a/docs/_posts/2020-07-11-kubernetes_gcp_detect_suspicious_kubectl_calls.md +++ b/docs/_posts/2020-07-11-kubernetes_gcp_detect_suspicious_kubectl_calls.md @@ -80,7 +80,7 @@ This search provides information on anonymous Kubectl calls with IP, verb namesp -#### Search +#### Search ``` `google_gcp_pubsub_message` data.protoPayload.requestMetadata.callerSuppliedUserAgent=kubectl* src_user=system:unsecured OR src_user=system:anonymous @@ -93,7 +93,8 @@ This search provides information on anonymous Kubectl calls with IP, verb namesp The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that **kubernetes_gcp_detect_suspicious_kubectl_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kubernetes_gcp_detect_suspicious_kubectl_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -118,6 +119,9 @@ Kubectl calls are not malicious by nature. However source IP, source user, user | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md index bd38511440..29fd0f9449 100644 --- a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md +++ b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md @@ -15,7 +15,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -90,7 +90,7 @@ This search provides information of unauthenticated requests via user agent, and -#### Search +#### Search ``` `google_gcp_pubsub_message` category=kube-audit @@ -104,7 +104,8 @@ This search provides information of unauthenticated requests via user agent, and The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that **gcp_kubernetes_cluster_pod_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **gcp_kubernetes_cluster_pod_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ Not all unauthenticated requests are malicious, but frequency, User Agent, sourc | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user.md b/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user.md index 7654631f46..9a8747995f 100644 --- a/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user.md +++ b/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user.md @@ -96,7 +96,7 @@ This search looks for AWS CloudTrail events where a user successfully launches a -#### Search +#### Search ``` `cloudtrail` eventName=RunInstances errorCode=success @@ -115,7 +115,8 @@ This search looks for AWS CloudTrail events where a user successfully launches a The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **abnormally_high_aws_instances_launched_by_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **abnormally_high_aws_instances_launched_by_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ Many service accounts configured within an AWS infrastructure are known to exhib | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user_-_mltk.md b/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user_-_mltk.md index 2acdda0b83..dfb59547fe 100644 --- a/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user_-_mltk.md +++ b/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user_-_mltk.md @@ -96,7 +96,7 @@ This search looks for AWS CloudTrail events where a user successfully launches a -#### Search +#### Search ``` `cloudtrail` eventName=RunInstances errorCode=success `abnormally_high_aws_instances_launched_by_user___mltk_filter` @@ -111,7 +111,8 @@ This search looks for AWS CloudTrail events where a user successfully launches a The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **abnormally_high_aws_instances_launched_by_user_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **abnormally_high_aws_instances_launched_by_user_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +141,9 @@ Many service accounts configured within an AWS infrastructure are known to exhib | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user.md b/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user.md index 06ccefd5c9..ef87c4ba5d 100644 --- a/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user.md +++ b/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user.md @@ -96,7 +96,7 @@ This search looks for AWS CloudTrail events where an abnormally high number of i -#### Search +#### Search ``` `cloudtrail` eventName=TerminateInstances errorCode=success @@ -115,7 +115,8 @@ This search looks for AWS CloudTrail events where an abnormally high number of i The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **abnormally_high_aws_instances_terminated_by_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **abnormally_high_aws_instances_terminated_by_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ Many service accounts configured with your AWS infrastructure are known to exhib | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user_-_mltk.md b/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user_-_mltk.md index a221308503..1ee2891b37 100644 --- a/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user_-_mltk.md +++ b/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user_-_mltk.md @@ -96,7 +96,7 @@ This search looks for AWS CloudTrail events where a user successfully terminates -#### Search +#### Search ``` `cloudtrail` eventName=TerminateInstances errorCode=success `abnormally_high_aws_instances_terminated_by_user___mltk_filter` @@ -111,7 +111,8 @@ This search looks for AWS CloudTrail events where a user successfully terminates The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **abnormally_high_aws_instances_terminated_by_user_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **abnormally_high_aws_instances_terminated_by_user_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ Many service accounts configured within an AWS infrastructure are known to exhib | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md index 34f6e23236..499d9cc18c 100644 --- a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md +++ b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md @@ -103,7 +103,7 @@ This search looks for attempts to stop security-related services on the endpoint -#### Search +#### Search ``` @@ -119,10 +119,11 @@ This search looks for attempts to stop security-related services on the endpoint #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -Note that **attempt_to_stop_security_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **attempt_to_stop_security_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -165,6 +166,9 @@ None identified. Attempts to disable security-related services should be identif | 20.0 | 40 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable security services on endpoint $dest$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service) diff --git a/docs/_posts/2020-07-21-clients_connecting_to_multiple_dns_servers.md b/docs/_posts/2020-07-21-clients_connecting_to_multiple_dns_servers.md index 786950d581..830148cba5 100644 --- a/docs/_posts/2020-07-21-clients_connecting_to_multiple_dns_servers.md +++ b/docs/_posts/2020-07-21-clients_connecting_to_multiple_dns_servers.md @@ -1,6 +1,6 @@ --- title: "Clients Connecting to Multiple DNS Servers" -excerpt: "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol +excerpt: "Exfiltration Over Unencrypted Non-C2 Protocol " categories: - Deprecated @@ -8,7 +8,7 @@ last_modified_at: 2020-07-21 toc: true toc_label: "" tags: - - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol + - Exfiltration Over Unencrypted Non-C2 Protocol - Exfiltration - Splunk Enterprise - Splunk Enterprise Security @@ -42,7 +42,7 @@ This search allows you to identify the endpoints that have connected to more tha | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration | +| [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted Non-C2 Protocol | Exfiltration | @@ -97,7 +97,7 @@ This search allows you to identify the endpoints that have connected to more tha -#### Search +#### Search ``` @@ -111,7 +111,8 @@ This search allows you to identify the endpoints that have connected to more tha The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **clients_connecting_to_multiple_dns_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **clients_connecting_to_multiple_dns_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ It's possible that an enterprise has more than five DNS servers that are configu | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md b/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md index 09d2294f80..0e6524ee31 100644 --- a/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md +++ b/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md @@ -98,7 +98,7 @@ This search looks for successful AWS CloudTrail activity by user accounts that a -#### Search +#### Search ``` `cloudtrail` errorCode=success @@ -121,7 +121,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **detect_aws_api_activities_from_unapproved_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_aws_api_activities_from_unapproved_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -161,6 +162,9 @@ It's likely that you'll find activity detected by users/service accounts that ar | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md index 28b4678a7c..b11e775c70 100644 --- a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md +++ b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md @@ -99,7 +99,7 @@ This search looks for DNS requests for phishing domains that are leveraging Evil -#### Search +#### Search ``` @@ -124,15 +124,16 @@ This search looks for DNS requests for phishing domains that are leveraging Evil #### Macros The SPL above uses the following Macros: * [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml) -* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml) -* [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml) * [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml) * [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml) +* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml) * [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml) +* [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml) +* [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -166,6 +167,9 @@ If a known good domain is not listed in the legit_domains.csv file, then the sea | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md index 5ee63364ce..ccb568a8e3 100644 --- a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md +++ b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md @@ -104,7 +104,7 @@ This search detects user accounts that have been locked out a relatively high nu -#### Search +#### Search ``` @@ -122,7 +122,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_excessive_user_account_lockouts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_excessive_user_account_lockouts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,6 +151,9 @@ It is possible that a legitimate user is experiencing an issue causing multiple | 36.0 | 60 | 60 | Multiple accounts have been locked out. Review $nodename$ and $result$ related to $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md b/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md index e5f277ad4b..236c388e61 100644 --- a/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md +++ b/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md @@ -1,6 +1,6 @@ --- title: "Detect Long DNS TXT Record Response" -excerpt: "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol +excerpt: "Exfiltration Over Unencrypted Non-C2 Protocol " categories: - Deprecated @@ -8,7 +8,7 @@ last_modified_at: 2020-07-21 toc: true toc_label: "" tags: - - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol + - Exfiltration Over Unencrypted Non-C2 Protocol - Exfiltration - Splunk Enterprise - Splunk Enterprise Security @@ -42,7 +42,7 @@ This search is used to detect attempts to use DNS tunneling, by calculating the | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration | +| [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted Non-C2 Protocol | Exfiltration | @@ -98,7 +98,7 @@ This search is used to detect attempts to use DNS tunneling, by calculating the -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_long_dns_txt_record_response_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_long_dns_txt_record_response_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ It's possible that legitimate TXT record responses can be long enough to trigger | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md b/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md index 141df73945..5a3a944eb6 100644 --- a/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md +++ b/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md @@ -96,7 +96,7 @@ This search looks for AWS CloudTrail events wherein a console login event by a u -#### Search +#### Search ``` `cloudtrail` eventName=ConsoleLogin @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **detect_new_user_aws_console_login_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_new_user_aws_console_login_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ When a legitimate new user logins for the first time, this activity will be dete | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md index df80b5f85e..095e0becf3 100644 --- a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md +++ b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md @@ -19,7 +19,7 @@ tags: - Network_Traffic --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -101,7 +101,7 @@ This search looks for outbound SMB connections made by hosts within your network -#### Search +#### Search ``` @@ -117,7 +117,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_outbound_smb_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_outbound_smb_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ It is likely that the outbound Server Message Block (SMB) traffic is legitimate, | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md index 1319165910..f63bd93959 100644 --- a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md +++ b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md @@ -18,7 +18,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -102,7 +102,7 @@ This search looks for execution of process `outlook.exe` where the process is wr -#### Search +#### Search ``` @@ -129,7 +129,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_outlook_exe_writing_a_zip_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_outlook_exe_writing_a_zip_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -160,6 +161,9 @@ It is not uncommon for outlook to write legitimate zip files to the disk. | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-detect_spike_in_aws_api_activity.md b/docs/_posts/2020-07-21-detect_spike_in_aws_api_activity.md index 2ad7cfff1c..1e97e020bb 100644 --- a/docs/_posts/2020-07-21-detect_spike_in_aws_api_activity.md +++ b/docs/_posts/2020-07-21-detect_spike_in_aws_api_activity.md @@ -97,7 +97,7 @@ This search will detect users creating spikes of API activity in your AWS enviro -#### Search +#### Search ``` `cloudtrail` eventType=AwsApiCall [search `cloudtrail` eventType=AwsApiCall @@ -126,7 +126,8 @@ This search will detect users creating spikes of API activity in your AWS enviro The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **detect_spike_in_aws_api_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_spike_in_aws_api_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -165,6 +166,9 @@ Detailed documentation on how to create a new field within Incident Review may b | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md index a472c25678..fffd3e2cd1 100644 --- a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md +++ b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md @@ -99,7 +99,7 @@ This search looks for the execution of the cscript.exe or wscript.exe processes, -#### Search +#### Search ``` @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_use_of_cmd_exe_to_launch_script_interpreters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_use_of_cmd_exe_to_launch_script_interpreters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ Some legitimate applications may exhibit this behavior. | 35.0 | 70 | 50 | cmd.exe launching script interpreters on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md index 9eaa499279..3a268ba8d5 100644 --- a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md +++ b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md @@ -96,7 +96,7 @@ This search looks for web connections to dynamic DNS providers. -#### Search +#### Search ``` @@ -113,7 +113,8 @@ The SPL above uses the following Macros: * [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_web_traffic_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_web_traffic_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ It is possible that list of dynamic DNS providers is outdated and/or that the UR | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md index 1c50c83df9..f1847426f7 100644 --- a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md +++ b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md @@ -17,7 +17,7 @@ tags: - Endpoint --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -97,7 +97,7 @@ This search looks for specific command-line arguments that may indicate the exec -#### Search +#### Search ``` @@ -113,7 +113,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detection_of_tools_built_by_nirsoft_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detection_of_tools_built_by_nirsoft_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ While legitimate, these NirSoft tools are prone to abuse. You should verfiy that | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-dns_query_requests_resolved_by_unauthorized_dns_servers.md b/docs/_posts/2020-07-21-dns_query_requests_resolved_by_unauthorized_dns_servers.md index 65361d4eee..3be35d640c 100644 --- a/docs/_posts/2020-07-21-dns_query_requests_resolved_by_unauthorized_dns_servers.md +++ b/docs/_posts/2020-07-21-dns_query_requests_resolved_by_unauthorized_dns_servers.md @@ -100,7 +100,7 @@ This search will detect DNS requests resolved by unauthorized DNS servers. Legit -#### Search +#### Search ``` @@ -113,7 +113,8 @@ This search will detect DNS requests resolved by unauthorized DNS servers. Legit The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **dns_query_requests_resolved_by_unauthorized_dns_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **dns_query_requests_resolved_by_unauthorized_dns_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ Legitimate DNS activity can be detected in this search. Investigate, verify and | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-dns_record_changed.md b/docs/_posts/2020-07-21-dns_record_changed.md index 8cee4ea6da..9acf678e0c 100644 --- a/docs/_posts/2020-07-21-dns_record_changed.md +++ b/docs/_posts/2020-07-21-dns_record_changed.md @@ -100,7 +100,7 @@ The search takes the DNS records and their answers results of the discovered_dns -#### Search +#### Search ``` @@ -128,7 +128,8 @@ The search takes the DNS records and their answers results of the discovered_dns The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **dns_record_changed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **dns_record_changed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -167,6 +168,9 @@ Legitimate DNS changes can be detected in this search. Investigate, verify and u | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md index ad9fe8d1d6..8c60af6e5e 100644 --- a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md +++ b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md @@ -95,7 +95,7 @@ This search looks for EC2 instances being modified by users who have not previou -#### Search +#### Search ``` `cloudtrail` `ec2_modification_api_calls` [search `cloudtrail` `ec2_modification_api_calls` errorCode=success @@ -122,7 +122,8 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **ec2_instance_modified_with_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **ec2_instance_modified_with_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -155,6 +156,9 @@ It's possible that a new user will start to modify EC2 instances when they haven | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md b/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md index 51bd896e6d..544d38067b 100644 --- a/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md +++ b/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md @@ -95,7 +95,7 @@ This search looks for EC2 instances being created by users who have not created -#### Search +#### Search ``` `cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunInstances errorCode=success @@ -120,7 +120,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **ec2_instance_started_with_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **ec2_instance_started_with_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ It's possible that a user will start to create EC2 instances when they haven't b | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md index 6783c4d82c..7692b49352 100644 --- a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md +++ b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md @@ -19,7 +19,7 @@ tags: - Endpoint --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -98,7 +98,7 @@ The search looks at the change-analysis data model and detects email files creat -#### Search +#### Search ``` @@ -114,7 +114,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **email_files_written_outside_of_the_outlook_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **email_files_written_outside_of_the_outlook_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ Administrators and users sometimes prefer backing up their email data by moving | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md index 0f49f83cd6..40ddae5064 100644 --- a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md +++ b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md @@ -19,7 +19,7 @@ tags: - Network_Traffic --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -102,7 +102,7 @@ This search looks for an increase of data transfers from your email server to yo -#### Search +#### Search ``` @@ -121,7 +121,8 @@ This search looks for an increase of data transfers from your email server to yo The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **email_servers_sending_high_volume_traffic_to_hosts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **email_servers_sending_high_volume_traffic_to_hosts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,6 +151,9 @@ The false-positive rate will vary based on how you set the deviation_threshold a | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-excessive_dns_failures.md b/docs/_posts/2020-07-21-excessive_dns_failures.md index cafbda87e0..5a532eccba 100644 --- a/docs/_posts/2020-07-21-excessive_dns_failures.md +++ b/docs/_posts/2020-07-21-excessive_dns_failures.md @@ -19,7 +19,7 @@ tags: - Network_Resolution --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -104,7 +104,7 @@ This search identifies DNS query failures by counting the number of DNS response -#### Search +#### Search ``` @@ -124,7 +124,8 @@ This search identifies DNS query failures by counting the number of DNS response The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **excessive_dns_failures_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **excessive_dns_failures_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ It is possible legitimate traffic can trigger this rule. Please investigate as a | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md b/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md index 5024fc7680..a2cd505783 100644 --- a/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md +++ b/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md @@ -102,7 +102,7 @@ This search looks for command-line arguments that use a `/c` parameter to execut -#### Search +#### Search ``` @@ -129,7 +129,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **first_time_seen_command_line_argument_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **first_time_seen_command_line_argument_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -168,6 +169,9 @@ Legitimate programs can also use command-line arguments to execute. Please verif | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md index d757011c18..3f65608097 100644 --- a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md +++ b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md @@ -18,7 +18,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -104,7 +104,7 @@ This search looks for the first and last time a Windows service is seen running -#### Search +#### Search ``` `wineventlog_system` EventCode=7036 @@ -118,10 +118,11 @@ This search looks for the first and last time a Windows service is seen running #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [previously_seen_windows_services_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_windows_services_window.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) -Note that **first_time_seen_running_windows_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **first_time_seen_running_windows_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -156,6 +157,9 @@ A previously unseen service is not necessarily malicious. Verify that the servic | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md index debff933c6..1300f82e7e 100644 --- a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md +++ b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md @@ -98,7 +98,7 @@ Attackers leverage an existing Windows binary, attrib.exe, to mark specific as h -#### Search +#### Search ``` @@ -114,7 +114,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **hiding_files_and_directories_with_attrib_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **hiding_files_and_directories_with_attrib_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ Some applications and users may legitimately use attrib.exe to interact with the | 72.0 | 90 | 80 | Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md index ab8a2539a5..254098fbd5 100644 --- a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md +++ b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md @@ -19,7 +19,7 @@ tags: - Network_Traffic --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -102,7 +102,7 @@ This search looks for an increase of data transfers from your email server to yo -#### Search +#### Search ``` @@ -121,7 +121,8 @@ This search looks for an increase of data transfers from your email server to yo The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **hosts_receiving_high_volume_of_network_traffic_from_email_server_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **hosts_receiving_high_volume_of_network_traffic_from_email_server_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ The false-positive rate will vary based on how you set the deviation_threshold a | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md index a8e0c8dcc1..4335d1cae2 100644 --- a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md +++ b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md @@ -103,7 +103,7 @@ This search looks for PowerShell processes started with parameters used to bypas -#### Search +#### Search ``` @@ -120,7 +120,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -Note that **malicious_powershell_process_-_execution_policy_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **malicious_powershell_process_-_execution_policy_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -157,6 +158,9 @@ There may be legitimate reasons to bypass the PowerShell execution policy. The P | 42.0 | 70 | 60 | PowerShell local execution policy bypass attempt on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md index 167413fe5b..67b077fd7c 100644 --- a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md +++ b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md @@ -24,7 +24,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -105,7 +105,7 @@ This search detects Okta login failures due to bad credentials for multiple user -#### Search +#### Search ``` `okta` outcome.reason=INVALID_CREDENTIALS @@ -122,7 +122,8 @@ The SPL above uses the following Macros: * [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -154,6 +155,9 @@ A single public IP address servicing multiple legitmate users may trigger this s | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-okta_account_lockout_events.md b/docs/_posts/2020-07-21-okta_account_lockout_events.md index fa8a72054e..950d260a4a 100644 --- a/docs/_posts/2020-07-21-okta_account_lockout_events.md +++ b/docs/_posts/2020-07-21-okta_account_lockout_events.md @@ -24,7 +24,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -105,7 +105,7 @@ Detect Okta user lockout events -#### Search +#### Search ``` `okta` displayMessage="Max sign in attempts exceeded" @@ -118,7 +118,8 @@ Detect Okta user lockout events The SPL above uses the following Macros: * [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) -Note that **okta_account_lockout_events_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **okta_account_lockout_events_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ None. Account lockouts should be followed up on to determine if the actual user | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md index ab0163d9ae..b8a910cb3c 100644 --- a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md +++ b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md @@ -24,7 +24,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -105,7 +105,7 @@ Detect failed Okta SSO events -#### Search +#### Search ``` `okta` displayMessage="User attempted unauthorized access to app" @@ -120,7 +120,8 @@ The SPL above uses the following Macros: * [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **okta_failed_sso_attempts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **okta_failed_sso_attempts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,6 +151,9 @@ There may be a faulty config preventing legitmate users from accessing apps they | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md index 78e8cdb22a..b22b9ddc09 100644 --- a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md +++ b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md @@ -24,7 +24,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -105,7 +105,7 @@ This search detects logins from the same user from different cities in a 24 hour -#### Search +#### Search ``` `okta` displayMessage="User login to Okta" client.geographicalContext.city!=null @@ -121,7 +121,8 @@ The SPL above uses the following Macros: * [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **okta_user_logins_from_multiple_cities_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **okta_user_logins_from_multiple_cities_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,6 +151,9 @@ Users in your enviornment may legitmately be travelling and loggin in from diffe | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md index b7ea7658fe..bb480e4e30 100644 --- a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md +++ b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md @@ -101,7 +101,7 @@ Microsoft Windows contains accessibility features that can be launched with a ke -#### Search +#### Search ``` @@ -117,7 +117,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **overwriting_accessibility_binaries_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **overwriting_accessibility_binaries_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ Microsoft may provide updates to these binaries. Verify that these changes do no | 72.0 | 80 | 90 | A suspicious file modification or replace in $file_path$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md index c7a40a36d0..de40ec98dd 100644 --- a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md +++ b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md @@ -16,7 +16,7 @@ tags: - Network_Traffic --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -98,7 +98,7 @@ This search looks for network traffic defined by port and transport layer protoc -#### Search +#### Search ``` @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **prohibited_network_traffic_allowed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **prohibited_network_traffic_allowed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ None identified | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md index b682435f08..9db7878838 100644 --- a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md +++ b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md @@ -1,6 +1,6 @@ --- title: "Protocol or Port Mismatch" -excerpt: "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol +excerpt: "Exfiltration Over Unencrypted Non-C2 Protocol , Exfiltration Over Alternative Protocol " categories: @@ -9,7 +9,7 @@ last_modified_at: 2020-07-21 toc: true toc_label: "" tags: - - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol + - Exfiltration Over Unencrypted Non-C2 Protocol - Exfiltration Over Alternative Protocol - Exfiltration - Exfiltration @@ -19,7 +19,7 @@ tags: - Network_Traffic --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -47,7 +47,7 @@ This search looks for network traffic on common ports where a higher layer proto | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration | +| [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted Non-C2 Protocol | Exfiltration | | [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration | @@ -102,7 +102,7 @@ This search looks for network traffic on common ports where a higher layer proto -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **protocol_or_port_mismatch_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **protocol_or_port_mismatch_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,6 +149,9 @@ None identified | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md index 37f58662c4..cc13491611 100644 --- a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md +++ b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md @@ -19,7 +19,7 @@ tags: - Network_Traffic --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -105,7 +105,7 @@ This search looks for RDP application network traffic and filters any source/des -#### Search +#### Search ``` @@ -121,7 +121,8 @@ This search looks for RDP application network traffic and filters any source/des The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **remote_desktop_network_bruteforce_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **remote_desktop_network_bruteforce_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ RDP gateways may have unusually high amounts of traffic from all other hosts' RD | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md index 9c59f4d181..f6b751b8c8 100644 --- a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md +++ b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md @@ -19,7 +19,7 @@ tags: - Endpoint --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -104,7 +104,7 @@ This search looks for the remote desktop process mstsc.exe running on systems up -#### Search +#### Search ``` @@ -120,7 +120,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **remote_desktop_process_running_on_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **remote_desktop_process_running_on_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,6 +151,9 @@ Remote Desktop may be used legitimately by users on the network. | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md index 42edcb7314..2809e872ca 100644 --- a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md +++ b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md @@ -106,7 +106,7 @@ This search looks for arguments to sc.exe indicating the creation or modificatio -#### Search +#### Search ``` @@ -122,7 +122,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **sc_exe_manipulating_windows_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **sc_exe_manipulating_windows_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -157,6 +158,9 @@ Using sc.exe to manipulate Windows services is uncommon. However, there may be l | 56.0 | 70 | 80 | A sc process $process_name$ with commandline $process$ to create of configure services in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md b/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md index 1f8d89fc7f..93158bad76 100644 --- a/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md +++ b/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md @@ -95,7 +95,7 @@ This search looks for flags passed to schtasks.exe on the command-line that indi -#### Search +#### Search ``` @@ -112,7 +112,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **scheduled_tasks_used_in_badrabbit_ransomware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **scheduled_tasks_used_in_badrabbit_ransomware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ No known false positives | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-22-smb_traffic_spike.md b/docs/_posts/2020-07-22-smb_traffic_spike.md index 3afb3f2a9f..7d528165f0 100644 --- a/docs/_posts/2020-07-22-smb_traffic_spike.md +++ b/docs/_posts/2020-07-22-smb_traffic_spike.md @@ -19,7 +19,7 @@ tags: - Network_Traffic --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -100,7 +100,7 @@ This search looks for spikes in the number of Server Message Block (SMB) traffic -#### Search +#### Search ``` @@ -118,7 +118,8 @@ This search looks for spikes in the number of Server Message Block (SMB) traffic The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **smb_traffic_spike_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **smb_traffic_spike_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ A file server may experience high-demand loads that could cause this analytic to | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md index ddfc7a6356..570b9a6312 100644 --- a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md +++ b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md @@ -19,7 +19,7 @@ tags: - Network_Traffic --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -100,7 +100,7 @@ This search uses the Machine Learning Toolkit (MLTK) to identify spikes in the n -#### Search +#### Search ``` @@ -120,7 +120,8 @@ This search uses the Machine Learning Toolkit (MLTK) to identify spikes in the n The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **smb_traffic_spike_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **smb_traffic_spike_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -155,6 +156,9 @@ If you are seeing more results than desired, you may consider reducing the value | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md b/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md index bd90a53202..d0a87ff921 100644 --- a/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md +++ b/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md @@ -96,7 +96,7 @@ This search looks for changes to registry values that control Windows file assoc -#### Search +#### Search ``` @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **suspicious_changes_to_file_associations_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_changes_to_file_associations_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ There may be other processes in your environment that users may legitimately use | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md b/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md index 531a73a8ed..baf1b346d7 100644 --- a/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md +++ b/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md @@ -93,7 +93,7 @@ This detection looks for emails that are suspicious because of their sender, dom -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **suspicious_email_-_uba_anomaly_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_email_-_uba_anomaly_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,6 +136,9 @@ This detection model will alert on any sender domain that is seen for the first | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md index bbf2b810b5..cdb3e48687 100644 --- a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md +++ b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md @@ -19,7 +19,7 @@ tags: - Email --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -103,7 +103,7 @@ This search looks for emails that have attachments with suspicious file extensio -#### Search +#### Search ``` @@ -118,10 +118,11 @@ This search looks for emails that have attachments with suspicious file extensio #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [suspicious_email_attachments](https://github.com/splunk/security_content/blob/develop/macros/suspicious_email_attachments.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [suspicious_email_attachments](https://github.com/splunk/security_content/blob/develop/macros/suspicious_email_attachments.yml) -Note that **suspicious_email_attachment_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_email_attachment_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ None identified | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md index 835f9a9be9..ffb70169e7 100644 --- a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md +++ b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md @@ -93,7 +93,7 @@ This search looks for reg.exe being launched from a command prompt not started b -#### Search +#### Search ``` @@ -117,7 +117,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **suspicious_reg_exe_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_reg_exe_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ It's possible for system administrators to write scripts that exhibit this behav | 35.0 | 70 | 50 | Suspicious $Processes.process_path.file_path$ process running with an uncommon parent process $Processes.parent_process_name$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://car.mitre.org/wiki/CAR-2013-03-001](https://car.mitre.org/wiki/CAR-2013-03-001) diff --git a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md index 930013dd49..50cb09ba63 100644 --- a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md +++ b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md @@ -92,7 +92,7 @@ This search detects writes to the 'System Volume Information' folder by somethin -#### Search +#### Search ``` (`sysmon` OR tag=process) EventCode=11 process_id!=4 file_path=*System\ Volume\ Information* @@ -107,7 +107,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **suspicious_writes_to_system_volume_information_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_writes_to_system_volume_information_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,6 +133,9 @@ It is possible that other utilities or system processes may legitimately write t | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md b/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md index 5987a21ca1..39b9dd913b 100644 --- a/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md +++ b/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md @@ -92,7 +92,7 @@ This search detects writes to the recycle bin by a process other than explorer.e -#### Search +#### Search ``` @@ -109,7 +109,8 @@ This search detects writes to the recycle bin by a process other than explorer.e The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **suspicious_writes_to_windows_recycle_bin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_writes_to_windows_recycle_bin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ Because the Recycle Bin is a hidden folder in modern versions of Windows, it wou | 28.0 | 40 | 70 | Suspicious writes to windows Recycle Bin process $Processes.process_name$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-22-tor_traffic.md b/docs/_posts/2020-07-22-tor_traffic.md index 3b6a70d3f6..247d47f93c 100644 --- a/docs/_posts/2020-07-22-tor_traffic.md +++ b/docs/_posts/2020-07-22-tor_traffic.md @@ -19,7 +19,7 @@ tags: - Network_Traffic --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -101,7 +101,7 @@ This search looks for network traffic identified as The Onion Router (TOR), a be -#### Search +#### Search ``` @@ -117,7 +117,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **tor_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **tor_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,6 +151,9 @@ None at this time | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md index 0b7b920267..7a2e68e15c 100644 --- a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md +++ b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md @@ -94,7 +94,7 @@ This search looks for applications on the endpoint that you have marked as uncom -#### Search +#### Search ``` @@ -108,11 +108,12 @@ This search looks for applications on the endpoint that you have marked as uncom #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [uncommon_processes](https://github.com/splunk/security_content/blob/develop/macros/uncommon_processes.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **uncommon_processes_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **uncommon_processes_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ None identified | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md b/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md index f562edb642..817c79db6e 100644 --- a/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md +++ b/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md @@ -98,7 +98,7 @@ Attackers often disable security tools to avoid detection. This search looks for -#### Search +#### Search ``` @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **unload_sysmon_filter_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **unload_sysmon_filter_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ You must be ingesting data that records process activity from your hosts to popu | 45.0 | 50 | 90 | Possible Sysmon filter driver unloading on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md index c85897c02a..7de9810079 100644 --- a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md +++ b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md @@ -18,7 +18,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -93,7 +93,7 @@ This search provides detection of an user attaching itself to a different role t -#### Search +#### Search ``` `aws_cloudwatchlogs_eks` attach policy @@ -106,7 +106,8 @@ This search provides detection of an user attaching itself to a different role t The SPL above uses the following Macros: * [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) -Note that **aws_detect_attach_to_role_policy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_detect_attach_to_role_policy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,6 +133,9 @@ Attach to policy can create a lot of noise. This search can be adjusted to provi | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md index 7717630ad3..057c9bdb9a 100644 --- a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md +++ b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md @@ -18,7 +18,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -93,7 +93,7 @@ This search provides detection of accounts creating permanent keys. Permanent ke -#### Search +#### Search ``` `aws_cloudwatchlogs_eks` CreateAccessKey @@ -107,7 +107,8 @@ This search provides detection of accounts creating permanent keys. Permanent ke The SPL above uses the following Macros: * [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) -Note that **aws_detect_permanent_key_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_detect_permanent_key_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ Not all permanent key creations are malicious. If there is a policy of rotating | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-27-aws_detect_role_creation.md b/docs/_posts/2020-07-27-aws_detect_role_creation.md index 9ca37b3f95..7e2f60f32a 100644 --- a/docs/_posts/2020-07-27-aws_detect_role_creation.md +++ b/docs/_posts/2020-07-27-aws_detect_role_creation.md @@ -18,7 +18,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -93,7 +93,7 @@ This search provides detection of role creation by IAM users. Role creation is a -#### Search +#### Search ``` `aws_cloudwatchlogs_eks` event_name=CreateRole action=created userIdentity.type=AssumedRole requestParameters.description=Allows* @@ -105,7 +105,8 @@ This search provides detection of role creation by IAM users. Role creation is a The SPL above uses the following Macros: * [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) -Note that **aws_detect_role_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_detect_role_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ CreateRole is not very common in common users. This search can be adjusted to pr | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md index dc24e80d99..fd0b96d06c 100644 --- a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md +++ b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md @@ -18,7 +18,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -93,7 +93,7 @@ This search provides detection of suspicious use of sts:AssumeRole. These tokens -#### Search +#### Search ``` `cloudtrail` user_type=AssumedRole userIdentity.sessionContext.sessionIssuer.type=Role @@ -105,7 +105,8 @@ This search provides detection of suspicious use of sts:AssumeRole. These tokens The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_detect_sts_assume_role_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_detect_sts_assume_role_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ Sts:AssumeRole can be very noisy as it is a standard mechanism to provide cross | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md index d2953dfdc9..1db0c81482 100644 --- a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md +++ b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md @@ -16,7 +16,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -91,7 +91,7 @@ This search provides detection of suspicious use of sts:GetSessionToken. These t -#### Search +#### Search ``` `aws_cloudwatchlogs_eks` ASIA userIdentity.type=IAMUser @@ -105,7 +105,8 @@ This search provides detection of suspicious use of sts:GetSessionToken. These t The SPL above uses the following Macros: * [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) -Note that **aws_detect_sts_get_session_token_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_detect_sts_get_session_token_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +141,9 @@ Sts:GetSessionToken can be very noisy as in certain environments numerous calls | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md index 0b1c2ee8bc..99bc5ce192 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md @@ -16,7 +16,7 @@ tags: - CVE-2020-1350 --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -100,7 +100,7 @@ This search detects SIGRed via Splunk Stream. -#### Search +#### Search ``` `stream_dns` @@ -117,10 +117,11 @@ This search detects SIGRed via Splunk Stream. #### Macros The SPL above uses the following Macros: -* [stream_tcp](https://github.com/splunk/security_content/blob/develop/macros/stream_tcp.yml) * [stream_dns](https://github.com/splunk/security_content/blob/develop/macros/stream_dns.yml) +* [stream_tcp](https://github.com/splunk/security_content/blob/develop/macros/stream_tcp.yml) -Note that **detect_windows_dns_sigred_via_splunk_stream_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_windows_dns_sigred_via_splunk_stream_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ unknown | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md index 48546e0906..5ad0ca9be6 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md @@ -17,7 +17,7 @@ tags: - Network_Resolution --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -101,7 +101,7 @@ This search detects SIGRed via Zeek DNS and Zeek Conn data. -#### Search +#### Search ``` @@ -120,7 +120,8 @@ This search detects SIGRed via Zeek DNS and Zeek Conn data. The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_windows_dns_sigred_via_zeek_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_windows_dns_sigred_via_zeek_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ unknown | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md index 3295629eba..ed79d1eb20 100644 --- a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md +++ b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md @@ -104,7 +104,7 @@ This search looks for cloud instances being modified by users who have not previ -#### Search +#### Search ``` @@ -125,7 +125,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **cloud_instance_modified_by_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **cloud_instance_modified_by_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -161,6 +162,9 @@ It's possible that a new user will start to modify EC2 instances when they haven | 42.0 | 70 | 60 | User $user$ is modifying an instance $dest$ for the first time. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md index 82d3d82913..4ead28c950 100644 --- a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md +++ b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md @@ -16,7 +16,7 @@ tags: - CVE-2020-5902 --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -100,7 +100,7 @@ This search detects remote code exploit attempts on F5 BIG-IP, BIG-IQ, and Traff -#### Search +#### Search ``` `f5_bigip_rogue` @@ -113,7 +113,8 @@ This search detects remote code exploit attempts on F5 BIG-IP, BIG-IQ, and Traff The SPL above uses the following Macros: * [f5_bigip_rogue](https://github.com/splunk/security_content/blob/develop/macros/f5_bigip_rogue.yml) -Note that **detect_f5_tmui_rce_cve-2020-5902_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_f5_tmui_rce_cve-2020-5902_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ unknown | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/](https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/) diff --git a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md index a03af31549..cdef5be4db 100644 --- a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md +++ b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md @@ -15,7 +15,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -96,7 +96,7 @@ This search looks for GCP PubSub events where a user has created an open/public -#### Search +#### Search ``` `google_gcp_pubsub_message` data.resource.type=gcs_bucket data.protoPayload.methodName=storage.setIamPermissions @@ -116,7 +116,8 @@ This search looks for GCP PubSub events where a user has created an open/public The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that **detect_new_open_gcp_storage_buckets_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_new_open_gcp_storage_buckets_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,6 +151,9 @@ While this search has no known false positives, it is possible that a GCP admin | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md index 4c1431e70c..71031283aa 100644 --- a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md +++ b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md @@ -15,7 +15,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -97,7 +97,7 @@ This search looks at GCP Storage bucket-access logs and detects new or previousl -#### Search +#### Search ``` `google_gcp_pubsub_message` @@ -125,7 +125,8 @@ This search looks at GCP Storage bucket-access logs and detects new or previousl The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that **detect_gcp_storage_access_from_a_new_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_gcp_storage_access_from_a_new_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -161,6 +162,9 @@ GCP Storage buckets can be accessed from any IP (if the ACLs are open to allow i | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-08-11-detect_arp_poisoning.md b/docs/_posts/2020-08-11-detect_arp_poisoning.md index 6465652152..0752fc5503 100644 --- a/docs/_posts/2020-08-11-detect_arp_poisoning.md +++ b/docs/_posts/2020-08-11-detect_arp_poisoning.md @@ -26,7 +26,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -115,7 +115,7 @@ By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organiza -#### Search +#### Search ``` `cisco_networks` facility="PM" mnemonic="ERR_DISABLE" disable_cause="arp-inspection" @@ -131,7 +131,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml) -Note that **detect_arp_poisoning_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_arp_poisoning_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -163,6 +164,9 @@ This search might be prone to high false positives if DHCP Snooping or ARP inspe | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md index d96f351723..43d526ffa5 100644 --- a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md +++ b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md @@ -22,7 +22,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -109,7 +109,7 @@ By enabling DHCP Snooping as a Layer 2 Security measure on the organization's ne -#### Search +#### Search ``` `cisco_networks` facility="DHCP_SNOOPING" mnemonic="DHCP_SNOOPING_UNTRUSTED_PORT" @@ -124,7 +124,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml) -Note that **detect_rogue_dhcp_server_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_rogue_dhcp_server_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -154,6 +155,9 @@ This search might be prone to high false positives if DHCP Snooping has been inc | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md index 9b1dd69f4f..c087d8625c 100644 --- a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md +++ b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md @@ -96,7 +96,7 @@ This search looks for cloud provisioning activities from previously unseen IP ad -#### Search +#### Search ``` @@ -117,7 +117,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [previously_unseen_cloud_provisioning_activity_window](https://github.com/splunk/security_content/blob/develop/macros/previously_unseen_cloud_provisioning_activity_window.yml) -Note that **cloud_provisioning_activity_from_previously_unseen_ip_address_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **cloud_provisioning_activity_from_previously_unseen_ip_address_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -154,6 +155,9 @@ This is a strictly behavioral search, so we define "false positive" slightly dif | 42.0 | 70 | 60 | User $user$ is starting or creating an instance $object_id$ for the first time from IP address $src$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md index 0279f608db..2c0d8b56e5 100644 --- a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md +++ b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md @@ -96,7 +96,7 @@ This search looks for cloud provisioning activities from previously unseen regio -#### Search +#### Search ``` @@ -119,7 +119,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [previously_unseen_cloud_provisioning_activity_window](https://github.com/splunk/security_content/blob/develop/macros/previously_unseen_cloud_provisioning_activity_window.yml) -Note that **cloud_provisioning_activity_from_previously_unseen_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **cloud_provisioning_activity_from_previously_unseen_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -156,6 +157,9 @@ This is a strictly behavioral search, so we define "false positive" slightly dif | 42.0 | 70 | 60 | User $user$ is starting or creating an instance $object$ for the first time in region $Region$ from IP address $src$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md index d4e391bfb8..20c0efb905 100644 --- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md +++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md @@ -25,7 +25,7 @@ tags: - Change --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -107,7 +107,7 @@ This search finds for the number successfully destroyed cloud instances for ever -#### Search +#### Search ``` @@ -131,7 +131,8 @@ This search finds for the number successfully destroyed cloud instances for ever #### Macros The SPL above uses the following Macros: -Note that **abnormally_high_number_of_cloud_instances_destroyed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **abnormally_high_number_of_cloud_instances_destroyed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -161,6 +162,9 @@ Many service accounts configured within a cloud infrastructure are known to exhi | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md index a99c78fd84..532a074da1 100644 --- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md +++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md @@ -25,7 +25,7 @@ tags: - Change --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -107,7 +107,7 @@ This search finds for the number successfully created cloud instances for every -#### Search +#### Search ``` @@ -131,7 +131,8 @@ This search finds for the number successfully created cloud instances for every #### Macros The SPL above uses the following Macros: -Note that **abnormally_high_number_of_cloud_instances_launched_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **abnormally_high_number_of_cloud_instances_launched_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -162,6 +163,9 @@ Many service accounts configured within an AWS infrastructure are known to exhib | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-09-01-gcp_detect_oauth_token_abuse.md b/docs/_posts/2020-09-01-gcp_detect_oauth_token_abuse.md index e0d866b8ac..fb7bc54890 100644 --- a/docs/_posts/2020-09-01-gcp_detect_oauth_token_abuse.md +++ b/docs/_posts/2020-09-01-gcp_detect_oauth_token_abuse.md @@ -91,7 +91,7 @@ This search provides detection of possible GCP Oauth token abuse. GCP Oauth toke -#### Search +#### Search ``` `google_gcp_pubsub_message` type.googleapis.com/google.cloud.audit.AuditLog @@ -103,7 +103,8 @@ This search provides detection of possible GCP Oauth token abuse. GCP Oauth toke The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that **gcp_detect_oauth_token_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **gcp_detect_oauth_token_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -128,6 +129,9 @@ GCP Oauth token abuse detection will only work if there are access policies in p | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.netskope.com/blog/gcp-oauth-token-hijacking-in-google-cloud-part-1](https://www.netskope.com/blog/gcp-oauth-token-hijacking-in-google-cloud-part-1) diff --git a/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md b/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md index b644f8f7e5..c296e5bf0f 100644 --- a/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md +++ b/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md @@ -94,7 +94,7 @@ This search looks at cloud-infrastructure events where an instance is created in -#### Search +#### Search ``` @@ -114,7 +114,8 @@ This search looks at cloud-infrastructure events where an instance is created in The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **cloud_compute_instance_created_in_previously_unused_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **cloud_compute_instance_created_in_previously_unused_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -148,6 +149,9 @@ It's possible that a user has unknowingly started an instance in a new region. P | 42.0 | 70 | 60 | User $user$ is creating an instance $dest$ in a new region for the first time | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md b/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md index da2d8c00e3..a89cace58a 100644 --- a/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md +++ b/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md @@ -96,7 +96,7 @@ This search looks for new commands from each user role. -#### Search +#### Search ``` @@ -117,7 +117,8 @@ This search looks for new commands from each user role. The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **cloud_api_calls_from_previously_unseen_user_roles_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **cloud_api_calls_from_previously_unseen_user_roles_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -152,6 +153,9 @@ You must be ingesting your cloud infrastructure logs from your cloud provider. | 36.0 | 60 | 60 | User $user$ of type AssumedRole attempting to execute new API calls $command$ that have not been seen before | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md index 2200390ded..21e2b92280 100644 --- a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md +++ b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md @@ -106,7 +106,7 @@ This search will detect a spike in the number of API calls made to your cloud in -#### Search +#### Search ``` @@ -131,7 +131,8 @@ This search will detect a spike in the number of API calls made to your cloud in #### Macros The SPL above uses the following Macros: -Note that **abnormally_high_number_of_cloud_infrastructure_api_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **abnormally_high_number_of_cloud_infrastructure_api_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -159,6 +160,9 @@ You must be ingesting your cloud infrastructure logs. You also must run the base | 15.0 | 30 | 50 | user $user$ has made $api_calls$ api calls, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md index 1b0d25e9a1..6b9d25d118 100644 --- a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md +++ b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md @@ -106,7 +106,7 @@ This search will detect a spike in the number of API calls made to your cloud in -#### Search +#### Search ``` @@ -131,7 +131,8 @@ This search will detect a spike in the number of API calls made to your cloud in #### Macros The SPL above uses the following Macros: -Note that **abnormally_high_number_of_cloud_security_group_api_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **abnormally_high_number_of_cloud_security_group_api_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -160,6 +161,9 @@ You must be ingesting your cloud infrastructure logs. You also must run the base | 15.0 | 30 | 50 | user $user$ has made $api_calls$ api calls related to security groups, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md b/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md index 782ccdacde..3b3f0a18be 100644 --- a/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md +++ b/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md @@ -85,7 +85,7 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo -#### Search +#### Search ``` `cloudtrail` eventName=DeleteNetworkAcl @@ -101,7 +101,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **cloud_network_access_control_list_deleted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **cloud_network_access_control_list_deleted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,6 +135,9 @@ It's possible that a user has legitimately deleted a network ACL. | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md b/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md index 801a2c8044..64c3c1f9dd 100644 --- a/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md +++ b/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md @@ -85,7 +85,7 @@ Find EC2 instances being created with previously unseen instance types. -#### Search +#### Search ``` @@ -107,7 +107,8 @@ Find EC2 instances being created with previously unseen instance types. The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **cloud_compute_instance_created_with_previously_unseen_instance_type_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **cloud_compute_instance_created_with_previously_unseen_instance_type_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -141,6 +142,9 @@ It is possible that an admin will create a new system using a new instance type | 30.0 | 50 | 60 | User $user$ is creating an instance $dest$ with an instance type $instance_type$ that has not been previously seen. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md index 46324de957..2fc6d92d8d 100644 --- a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md +++ b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md @@ -16,7 +16,7 @@ tags: - CVE-2020-1472 --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -100,7 +100,7 @@ This search detects attempts to run exploits for the Zerologon CVE-2020-1472 vul -#### Search +#### Search ``` `zeek_rpc` operation IN (NetrServerPasswordSet2,NetrServerReqChallenge,NetrServerAuthenticate3) @@ -114,7 +114,8 @@ This search detects attempts to run exploits for the Zerologon CVE-2020-1472 vul The SPL above uses the following Macros: * [zeek_rpc](https://github.com/splunk/security_content/blob/develop/macros/zeek_rpc.yml) -Note that **detect_zerologon_via_zeek_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_zerologon_via_zeek_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +141,9 @@ unknown | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.secura.com/blog/zero-logon](https://www.secura.com/blog/zero-logon) diff --git a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md index e63ca13fe5..be54cb74f9 100644 --- a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md +++ b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md @@ -99,7 +99,7 @@ This search looks for the creation or deletion of hidden shares using net.exe. -#### Search +#### Search ``` @@ -114,10 +114,11 @@ This search looks for the creation or deletion of hidden shares using net.exe. #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -Note that **create_or_delete_windows_shares_using_net_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **create_or_delete_windows_shares_using_net_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ Administrators often leverage net.exe to create or delete network shares. You sh | 25.0 | 50 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ enumerating Windows file shares. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1070/005](https://attack.mitre.org/techniques/T1070/005) diff --git a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md index 19bdc2592b..dc228a36ff 100644 --- a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md +++ b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md @@ -16,7 +16,7 @@ tags: - CVE-2020-1472 --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -101,7 +101,7 @@ This search looks for Event Code 4742 (Computer Change) or EventCode 4624 (An ac -#### Search +#### Search ``` `wineventlog_security` EventCode=4624 OR EventCode=4742 TargetUserName="ANONYMOUS LOGON" LogonType=3 @@ -113,7 +113,8 @@ This search looks for Event Code 4742 (Computer Change) or EventCode 4624 (An ac The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **detect_computer_changed_with_anonymous_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_computer_changed_with_anonymous_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ None thus far found | 49.0 | 70 | 70 | The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the an account or group being changed by an anonymous account. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.lares.com/blog/from-lares-labs-defensive-guidance-for-zerologon-cve-2020-1472/](https://www.lares.com/blog/from-lares-labs-defensive-guidance-for-zerologon-cve-2020-1472/) diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md index b9d0037aca..9ee267ad79 100644 --- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md +++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md @@ -94,7 +94,7 @@ This search looks for AWS CloudTrail events wherein a console login event by a u -#### Search +#### Search ``` @@ -119,7 +119,8 @@ This search looks for AWS CloudTrail events wherein a console login event by a u The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **detect_aws_console_login_by_user_from_new_city_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_aws_console_login_by_user_from_new_city_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -153,6 +154,9 @@ When a legitimate new user logins for the first time, this activity will be dete | 18.0 | 30 | 60 | User $user$ is logging into the AWS console from City $City$ for the first time | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md index 6ee99dd331..0fde12e800 100644 --- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md +++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md @@ -94,7 +94,7 @@ This search looks for AWS CloudTrail events wherein a console login event by a u -#### Search +#### Search ``` @@ -119,7 +119,8 @@ This search looks for AWS CloudTrail events wherein a console login event by a u The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **detect_aws_console_login_by_user_from_new_country_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_aws_console_login_by_user_from_new_country_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -153,6 +154,9 @@ When a legitimate new user logins for the first time, this activity will be dete | 42.0 | 70 | 60 | User $user$ is logging into the AWS console from Country $Country$ for the first time | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md index a0e2d6dd2c..1f91e6903d 100644 --- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md +++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md @@ -94,7 +94,7 @@ This search looks for AWS CloudTrail events wherein a console login event by a u -#### Search +#### Search ``` @@ -119,7 +119,8 @@ This search looks for AWS CloudTrail events wherein a console login event by a u The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **detect_aws_console_login_by_user_from_new_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_aws_console_login_by_user_from_new_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -153,6 +154,9 @@ When a legitimate new user logins for the first time, this activity will be dete | 36.0 | 60 | 60 | User $user$ is logging into the AWS console from Region $Region$ for the first time | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md index 3bf0522a69..aa535ba6cc 100644 --- a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md +++ b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md @@ -18,7 +18,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -93,7 +93,7 @@ This search provides detection of GCPloit exploitation framework. This framework -#### Search +#### Search ``` `google_gcp_pubsub_message` data.protoPayload.request.function.timeout=539s @@ -105,7 +105,8 @@ This search provides detection of GCPloit exploitation framework. This framework The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that **gcp_detect_gcploit_framework_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **gcp_detect_gcploit_framework_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ Payload.request.function.timeout value can possibly be match with other function | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/dxa4481/gcploit](https://github.com/dxa4481/gcploit) diff --git a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md index 66e1214f64..e3c728eb78 100644 --- a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md +++ b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md @@ -96,7 +96,7 @@ This search looks for cloud provisioning activities from previously unseen citie -#### Search +#### Search ``` @@ -119,7 +119,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [previously_unseen_cloud_provisioning_activity_window](https://github.com/splunk/security_content/blob/develop/macros/previously_unseen_cloud_provisioning_activity_window.yml) -Note that **cloud_provisioning_activity_from_previously_unseen_city_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **cloud_provisioning_activity_from_previously_unseen_city_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -156,6 +157,9 @@ This is a strictly behavioral search, so we define "false positive" slightly dif | 18.0 | 30 | 60 | User $user$ is starting or creating an instance $dest$ for the first time in City $City$ from IP address $src$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md index 3f3aa6c7f5..e064cb3acc 100644 --- a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md +++ b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md @@ -96,7 +96,7 @@ This search looks for cloud provisioning activities from previously unseen count -#### Search +#### Search ``` @@ -118,7 +118,8 @@ This search looks for cloud provisioning activities from previously unseen count The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **cloud_provisioning_activity_from_previously_unseen_country_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **cloud_provisioning_activity_from_previously_unseen_country_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -155,6 +156,9 @@ This is a strictly behavioral search, so we define "false positive" slightly dif | 42.0 | 70 | 60 | User $user$ is starting or creating an instance $object$ for the first time in Country $Country$ from IP address $src$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-10-09-gcp_detect_accounts_with_high_risk_roles_by_project.md b/docs/_posts/2020-10-09-gcp_detect_accounts_with_high_risk_roles_by_project.md index e0a94ebbf9..1a6441339c 100644 --- a/docs/_posts/2020-10-09-gcp_detect_accounts_with_high_risk_roles_by_project.md +++ b/docs/_posts/2020-10-09-gcp_detect_accounts_with_high_risk_roles_by_project.md @@ -91,7 +91,7 @@ This search provides detection of accounts with high risk roles by projects. Com -#### Search +#### Search ``` `google_gcp_pubsub_message` data.protoPayload.request.policy.bindings{}.role=roles/owner OR roles/editor OR roles/iam.serviceAccountUser OR roles/iam.serviceAccountAdmin OR roles/iam.serviceAccountTokenCreator OR roles/dataflow.developer OR roles/dataflow.admin OR roles/composer.admin OR roles/dataproc.admin OR roles/dataproc.editor @@ -103,7 +103,8 @@ This search provides detection of accounts with high risk roles by projects. Com The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that **gcp_detect_accounts_with_high_risk_roles_by_project_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **gcp_detect_accounts_with_high_risk_roles_by_project_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,6 +135,9 @@ Accounts with high risk roles should be reduced to the minimum number needed, ho | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/dxa4481/gcploit](https://github.com/dxa4481/gcploit) diff --git a/docs/_posts/2020-10-09-gcp_detect_high_risk_permissions_by_resource_and_account.md b/docs/_posts/2020-10-09-gcp_detect_high_risk_permissions_by_resource_and_account.md index 7c806051f4..ac97b4b4d7 100644 --- a/docs/_posts/2020-10-09-gcp_detect_high_risk_permissions_by_resource_and_account.md +++ b/docs/_posts/2020-10-09-gcp_detect_high_risk_permissions_by_resource_and_account.md @@ -91,7 +91,7 @@ This search provides detection of high risk permissions by resource and accounts -#### Search +#### Search ``` `google_gcp_pubsub_message` data.protoPayload.authorizationInfo{}.permission=iam.serviceAccounts.getaccesstoken OR iam.serviceAccounts.setIamPolicy OR iam.serviceAccounts.actas OR dataflow.jobs.create OR composer.environments.create OR dataproc.clusters.create @@ -103,7 +103,8 @@ This search provides detection of high risk permissions by resource and accounts The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that **gcp_detect_high_risk_permissions_by_resource_and_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **gcp_detect_high_risk_permissions_by_resource_and_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,6 +135,9 @@ High risk permissions are part of any GCP environment, however it is important t | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/dxa4481/gcploit](https://github.com/dxa4481/gcploit) diff --git a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md index 6bdaedeebb..d0b9b40fbe 100644 --- a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md +++ b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md @@ -104,7 +104,7 @@ This search looks for specific authentication events from the Windows Security E -#### Search +#### Search ``` `wineventlog_security` EventCode=4624 (Logon_Type=3 Logon_Process=NtLmSsp WorkstationName=WORKSTATION NOT AccountName="ANONYMOUS LOGON") OR (Logon_Type=9 Logon_Process=seclogo) @@ -117,10 +117,11 @@ This search looks for specific authentication events from the Windows Security E #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **detect_activity_related_to_pass_the_hash_attacks_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_activity_related_to_pass_the_hash_attacks_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ Legitimate logon activity by authorized NTLM systems may be detected by this sea | 49.0 | 70 | 70 | The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the pass the hash technique. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md index c1c882fb2f..6326887355 100644 --- a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md +++ b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md @@ -15,7 +15,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -96,7 +96,7 @@ This search looks for commands that the SNICat tool uses in the TLS SNI field. -#### Search +#### Search ``` `zeek_ssl` @@ -121,7 +121,8 @@ This search looks for commands that the SNICat tool uses in the TLS SNI field. The SPL above uses the following Macros: * [zeek_ssl](https://github.com/splunk/security_content/blob/develop/macros/zeek_ssl.yml) -Note that **detect_snicat_sni_exfiltration_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_snicat_sni_exfiltration_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ Unknown | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.mnemonic.no/blog/introducing-snicat/](https://www.mnemonic.no/blog/introducing-snicat/) diff --git a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md index ad87299971..2d5634c5b4 100644 --- a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md +++ b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md @@ -26,7 +26,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -115,7 +115,7 @@ By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organiz -#### Search +#### Search ``` `cisco_networks` facility="SISF" mnemonic IN ("IP_THEFT","MAC_THEFT","MAC_AND_IP_THEFT","PAK_DROP") @@ -133,7 +133,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml) -Note that **detect_ipv6_network_infrastructure_threats_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_ipv6_network_infrastructure_threats_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -168,6 +169,9 @@ None currently known | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/BRKSEC-3200.pdf](https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/BRKSEC-3200.pdf) diff --git a/docs/_posts/2020-10-28-detect_port_security_violation.md b/docs/_posts/2020-10-28-detect_port_security_violation.md index 786ba978e5..28877b30b2 100644 --- a/docs/_posts/2020-10-28-detect_port_security_violation.md +++ b/docs/_posts/2020-10-28-detect_port_security_violation.md @@ -26,7 +26,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -116,7 +116,7 @@ By enabling Port Security on a Cisco switch you can restrict input to an interfa -#### Search +#### Search ``` `cisco_networks` (facility="PM" mnemonic="ERR_DISABLE" disable_cause="psecure-violation") OR (facility="PORT_SECURITY" mnemonic="PSECURE_VIOLATION" OR mnemonic="PSECURE_VIOLATION_VLAN") @@ -132,7 +132,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml) -Note that **detect_port_security_violation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_port_security_violation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -167,6 +168,9 @@ This search might be prone to high false positives if you have malfunctioning de | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md index 3a56623bc2..8d4f5efe9d 100644 --- a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md +++ b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md @@ -21,7 +21,7 @@ tags: - Network_Traffic --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -104,7 +104,7 @@ Adversaries may abuse netbooting to load an unauthorized network device operatin -#### Search +#### Search ``` @@ -120,7 +120,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_software_download_to_network_device_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_software_download_to_network_device_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ This search will also report any legitimate attempts of software downloads to ne | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-10-28-detect_traffic_mirroring.md b/docs/_posts/2020-10-28-detect_traffic_mirroring.md index 904a89f2a2..dbabb833ba 100644 --- a/docs/_posts/2020-10-28-detect_traffic_mirroring.md +++ b/docs/_posts/2020-10-28-detect_traffic_mirroring.md @@ -24,7 +24,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -112,7 +112,7 @@ Adversaries may leverage traffic mirroring in order to automate data exfiltratio -#### Search +#### Search ``` `cisco_networks` (facility="MIRROR" mnemonic="ETH_SPAN_SESSION_UP") OR (facility="SPAN" mnemonic="SESSION_UP") OR (facility="SPAN" mnemonic="PKTCAP_START") OR (mnemonic="CFGLOG_LOGGEDCMD" command="monitor session*") @@ -127,7 +127,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml) -Note that **detect_traffic_mirroring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_traffic_mirroring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -155,6 +156,9 @@ This search will return false positives for any legitimate traffic captures by n | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-11-06-ryuk_test_files_detected.md b/docs/_posts/2020-11-06-ryuk_test_files_detected.md index a19fa43602..6a66bed515 100644 --- a/docs/_posts/2020-11-06-ryuk_test_files_detected.md +++ b/docs/_posts/2020-11-06-ryuk_test_files_detected.md @@ -93,7 +93,7 @@ The search looks for files that contain the key word *Ryuk* under any folder in -#### Search +#### Search ``` @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **ryuk_test_files_detected_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **ryuk_test_files_detected_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ If there are files with this keywoord as file names it might trigger false possi | 70.0 | 70 | 100 | A creation of ryuk test file $file_path$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md b/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md index 5f3cc1b3d5..4bdd7de48a 100644 --- a/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md +++ b/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md @@ -93,7 +93,7 @@ The search looks for the Console Window Host process (connhost.exe) executed usi -#### Search +#### Search ``` @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_connhost_exe_started_forcefully_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_connhost_exe_started_forcefully_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,6 +135,9 @@ This process should not be ran forcefully, we have not see any false positives f | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md index 48c92c2ecf..d99aeff9a0 100644 --- a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md +++ b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md @@ -93,7 +93,7 @@ The search looks for a Windows Security Account Manager (SAM) was stopped via co -#### Search +#### Search ``` @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_security_account_manager_stopped_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_security_account_manager_stopped_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ SAM is a critical windows service, stopping it would cause major issues on an en | 70.0 | 70 | 100 | The Windows Security Account Manager (SAM) was stopped via cli by $user$ on $dest$ by this command: $processs$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-11-09-common_ransomware_extensions.md b/docs/_posts/2020-11-09-common_ransomware_extensions.md index 374ba62d0b..79ee301ed0 100644 --- a/docs/_posts/2020-11-09-common_ransomware_extensions.md +++ b/docs/_posts/2020-11-09-common_ransomware_extensions.md @@ -94,7 +94,7 @@ The search looks for file modifications with extensions commonly used by Ransomw -#### Search +#### Search ``` @@ -113,7 +113,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [ransomware_extensions](https://github.com/splunk/security_content/blob/develop/macros/ransomware_extensions.yml) -Note that **common_ransomware_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **common_ransomware_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ It is possible for a legitimate file with these extensions to be created. If thi | 90.0 | 90 | 100 | A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware file extension and should be reviewed immediately. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-11-09-common_ransomware_notes.md b/docs/_posts/2020-11-09-common_ransomware_notes.md index bd1c2ce952..59d111606c 100644 --- a/docs/_posts/2020-11-09-common_ransomware_notes.md +++ b/docs/_posts/2020-11-09-common_ransomware_notes.md @@ -94,7 +94,7 @@ The search looks for files created with names matching those typically used in r -#### Search +#### Search ``` @@ -112,7 +112,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [ransomware_notes](https://github.com/splunk/security_content/blob/develop/macros/ransomware_notes.yml) -Note that **common_ransomware_notes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **common_ransomware_notes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ It's possible that a legitimate file could be created with the same name used by | 90.0 | 90 | 100 | A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware note file and should be reviewed immediately. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-11-09-deleting_shadow_copies.md b/docs/_posts/2020-11-09-deleting_shadow_copies.md index 354e71d899..16692424ea 100644 --- a/docs/_posts/2020-11-09-deleting_shadow_copies.md +++ b/docs/_posts/2020-11-09-deleting_shadow_copies.md @@ -96,7 +96,7 @@ The vssadmin.exe utility is used to interact with the Volume Shadow Copy Service -#### Search +#### Search ``` @@ -112,7 +112,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **deleting_shadow_copies_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **deleting_shadow_copies_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ vssadmin.exe and wmic.exe are standard applications shipped with modern versions | 81.0 | 90 | 90 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete shadow copies. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md index ea3aefddba..de24ad37ea 100644 --- a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md +++ b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md @@ -104,7 +104,7 @@ This search identifies endpoints that have caused a relatively high number of ac -#### Search +#### Search ``` @@ -122,7 +122,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_excessive_account_lockouts_from_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_excessive_account_lockouts_from_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -155,6 +156,9 @@ It's possible that a widely used system, such as a kiosk, could cause a large nu | 36.0 | 60 | 60 | Multiple accounts have been locked out. Review $dest$ and results related to $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md index 64292d0871..8875fc791c 100644 --- a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md +++ b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md @@ -96,7 +96,7 @@ This search looks for fast execution of processes used for system network config -#### Search +#### Search ``` @@ -117,7 +117,8 @@ The SPL above uses the following Macros: * [system_network_configuration_discovery_tools](https://github.com/splunk/security_content/blob/develop/macros/system_network_configuration_discovery_tools.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_processes_used_for_system_network_configuration_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_processes_used_for_system_network_configuration_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ It is uncommon for normal users to execute a series of commands used for network | 32.0 | 40 | 80 | An instance of $parent_process_name$ spawning multiple $process_name$ was identified on endpoint $dest$ by user $user$ typically not a normal behavior of the process. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md index a1276acbaa..48fee0d1f4 100644 --- a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md +++ b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md @@ -99,7 +99,7 @@ This search looks for executions of cmd.exe spawned by a process that is often a -#### Search +#### Search ``` @@ -113,12 +113,13 @@ This search looks for executions of cmd.exe spawned by a process that is often a #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml) -Note that **detect_prohibited_applications_spawning_cmd_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_prohibited_applications_spawning_cmd_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -157,6 +158,9 @@ There are circumstances where an application may legitimately execute and intera | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running prohibited applications. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-11-18-disabling_remote_user_account_control.md b/docs/_posts/2020-11-18-disabling_remote_user_account_control.md index 6098a953f6..15b67e345c 100644 --- a/docs/_posts/2020-11-18-disabling_remote_user_account_control.md +++ b/docs/_posts/2020-11-18-disabling_remote_user_account_control.md @@ -100,7 +100,7 @@ The search looks for modifications to registry keys that control the enforcement -#### Search +#### Search ``` @@ -113,7 +113,8 @@ The search looks for modifications to registry keys that control the enforcement The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **disabling_remote_user_account_control_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disabling_remote_user_account_control_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ This registry key may be modified via administrators to implement a change in sy | 42.0 | 70 | 60 | The Windows registry keys that control the enforcement of Windows User Account Control (UAC) were modified on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md index 23dc41558f..f263bd94f6 100644 --- a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md +++ b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md @@ -101,7 +101,7 @@ This search looks for processes launched from files that have double extensions -#### Search +#### Search ``` @@ -117,7 +117,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **execution_of_file_with_multiple_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **execution_of_file_with_multiple_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ None identified. | 56.0 | 80 | 70 | process $process$ have double extensions in the file name is executed on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md b/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md index 5a06fca29c..e29e4ba88a 100644 --- a/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md +++ b/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md @@ -96,7 +96,7 @@ This search looks for processes launched from files with at least five spaces in -#### Search +#### Search ``` @@ -112,7 +112,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **execution_of_file_with_spaces_before_extension_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **execution_of_file_with_spaces_before_extension_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ None identified. | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-11-23-processes_created_by_netsh.md b/docs/_posts/2020-11-23-processes_created_by_netsh.md index d587be595f..662d97698a 100644 --- a/docs/_posts/2020-11-23-processes_created_by_netsh.md +++ b/docs/_posts/2020-11-23-processes_created_by_netsh.md @@ -94,7 +94,7 @@ This search looks for processes launching netsh.exe to execute various commands -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **processes_created_by_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **processes_created_by_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,6 +136,9 @@ It is unusual for netsh.exe to have any child processes in most environments. It | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md index 86f9d3ceef..7a67601eb1 100644 --- a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md +++ b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md @@ -100,7 +100,7 @@ This search detects the process execution and arguments required to silently cre -#### Search +#### Search ``` @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **shim_database_installation_with_suspicious_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **shim_database_installation_with_suspicious_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ None identified | 63.0 | 70 | 90 | A process $process_name$ that possible create a shim db silently in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md index 35fed26523..c1fa093d80 100644 --- a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md +++ b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md @@ -108,7 +108,7 @@ The search looks for reg.exe modifying registry keys that define Windows service -#### Search +#### Search ``` @@ -124,7 +124,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **reg_exe_manipulating_windows_services_registry_keys_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **reg_exe_manipulating_windows_services_registry_keys_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -157,6 +158,9 @@ It is unusual for a service to be created or modified by directly manipulating t | 45.0 | 75 | 60 | A reg.exe process $process_name$ with commandline $process$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md index 20069803d5..240f39956d 100644 --- a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md +++ b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md @@ -102,7 +102,7 @@ This search looks for flags passed to schtasks.exe on the command-line that indi -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **schtasks_used_for_forcing_a_reboot_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **schtasks_used_for_forcing_a_reboot_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ Administrators may create jobs on systems forcing reboots to perform updates, ma | 56.0 | 70 | 80 | A schedule task process $process_name$ with force reboot commandline $process$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-12-08-shim_database_file_creation.md b/docs/_posts/2020-12-08-shim_database_file_creation.md index 04285b6b4a..e73f9f0b48 100644 --- a/docs/_posts/2020-12-08-shim_database_file_creation.md +++ b/docs/_posts/2020-12-08-shim_database_file_creation.md @@ -99,7 +99,7 @@ This search looks for shim database files being written to default directories. -#### Search +#### Search ``` @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **shim_database_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **shim_database_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ Because legitimate shim files are created and used all the time, this event, in | 56.0 | 70 | 80 | A process that possibly write shim database in $file_path$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md index 91df5dc322..c8d86682bb 100644 --- a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md +++ b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md @@ -99,7 +99,7 @@ This search looks for process names that consist only of a single letter. -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **single_letter_process_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **single_letter_process_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ Single-letter executables are not always malicious. Investigate this activity wi | 63.0 | 70 | 90 | A suspicious process $process_name$ with single letter in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md index 53f9e6e79e..9af29366a3 100644 --- a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md +++ b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md @@ -101,7 +101,7 @@ During triage, review the parallel processes - what process moved the native Win -#### Search +#### Search ``` @@ -119,7 +119,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [is_windows_system_file](https://github.com/splunk/security_content/blob/develop/macros/is_windows_system_file.yml) -Note that **system_processes_run_from_unexpected_locations_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **system_processes_run_from_unexpected_locations_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -154,6 +155,9 @@ This detection may require tuning based on third party applications utilizing na | 49.0 | 70 | 70 | System process running from unexpected location on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml) diff --git a/docs/_posts/2020-12-08-unusually_long_command_line.md b/docs/_posts/2020-12-08-unusually_long_command_line.md index 686e0c24f6..2bdfc98f68 100644 --- a/docs/_posts/2020-12-08-unusually_long_command_line.md +++ b/docs/_posts/2020-12-08-unusually_long_command_line.md @@ -12,7 +12,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -87,7 +87,7 @@ Command lines that are extremely long may be indicative of malicious activity on -#### Search +#### Search ``` @@ -108,7 +108,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **unusually_long_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **unusually_long_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +141,9 @@ Some legitimate applications start with long command lines. | 42.0 | 70 | 60 | Unusually long command line $Processes.process_name$ on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md b/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md index 7eb1110305..4747ad8212 100644 --- a/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md +++ b/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md @@ -108,7 +108,7 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons -#### Search +#### Search ``` `sysmon` EventCode=21 @@ -121,7 +121,8 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons The SPL above uses the following Macros: * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **wmi_permanent_event_subscription_-_sysmon_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **wmi_permanent_event_subscription_-_sysmon_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -154,6 +155,9 @@ Although unlikely, administrators may use event subscriptions for legitimate pur | 30.0 | 30 | 100 | User $user$ on $host$ executed the following suspicious WMI query: $Query$. Filter: $filter$. Consumer: $Consumer$. EventCode: $EventCode$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md) diff --git a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md index 2e2f0b86b0..374f9ef714 100644 --- a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md +++ b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md @@ -15,7 +15,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -95,7 +95,7 @@ The malware sunburst will load the malicious dll by SolarWinds.BusinessLayerHost -#### Search +#### Search ``` (`sysmon` EventCode=7 ImageLoaded=*SolarWinds.Orion.Core.BusinessLayer.dll) OR (`sysmon` EventCode=22 QueryName=*avsvmcloud.com) @@ -113,7 +113,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **sunburst_correlation_dll_and_network_event_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **sunburst_correlation_dll_and_network_event_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ unknown | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html](https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html) diff --git a/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md b/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md index 83d5af74c2..f707e67d87 100644 --- a/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md +++ b/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md @@ -98,7 +98,7 @@ This search detects the assignment of rights to accesss content from another mai -#### Search +#### Search ``` `o365_management_activity` Operation=Add-MailboxPermission @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) -Note that **o365_suspicious_rights_delegation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **o365_suspicious_rights_delegation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ Service Accounts | 48.0 | 80 | 60 | User $user$ has delegated suspicious rights $AccessRights$ to user $dest_user$ that allow access to sensitive | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md index e5ddbf3202..93dfbab852 100644 --- a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md +++ b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md @@ -18,7 +18,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -100,7 +100,7 @@ This search will detect more than 5 login failures in Office365 Azure Active Dir -#### Search +#### Search ``` `o365_management_activity` Operation=UserLoginFailed record_type=AzureActiveDirectoryStsLogon app=AzureActiveDirectory @@ -113,7 +113,8 @@ This search will detect more than 5 login failures in Office365 Azure Active Dir The SPL above uses the following Macros: * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) -Note that **high_number_of_login_failures_from_a_single_source_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **high_number_of_login_failures_from_a_single_source_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,6 +149,9 @@ unknown | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-12-16-o365_pst_export_alert.md b/docs/_posts/2020-12-16-o365_pst_export_alert.md index b425269e6a..0c276f675c 100644 --- a/docs/_posts/2020-12-16-o365_pst_export_alert.md +++ b/docs/_posts/2020-12-16-o365_pst_export_alert.md @@ -88,7 +88,7 @@ This search detects when a user has performed an Ediscovery search or exported a -#### Search +#### Search ``` `o365_management_activity` Category=ThreatManagement Name="eDiscovery search started or exported" @@ -103,7 +103,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) -Note that **o365_pst_export_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **o365_pst_export_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,6 +136,9 @@ PST export can be done for legitimate purposes but due to the sensitive nature o | 48.0 | 80 | 60 | User $Source$ has exported a PST file from the search using this operation- $Operation$ with a severity of $Severity$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1114/](https://attack.mitre.org/techniques/T1114/) diff --git a/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md b/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md index 3ec56211fa..15694a1be7 100644 --- a/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md +++ b/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md @@ -98,7 +98,7 @@ This search detects when an admin configured a forwarding rule for multiple mail -#### Search +#### Search ``` `o365_management_activity` Operation=Set-Mailbox @@ -117,7 +117,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) -Note that **o365_suspicious_admin_email_forwarding_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **o365_suspicious_admin_email_forwarding_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ unknown | 48.0 | 80 | 60 | User $user$ has configured a forwarding rule for multiple mailboxes to the same destination $ForwardingAddress$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md b/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md index c1812cfb76..cb92c6b18f 100644 --- a/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md +++ b/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md @@ -98,7 +98,7 @@ This search detects when multiple user configured a forwarding rule to the same -#### Search +#### Search ``` `o365_management_activity` Operation=Set-Mailbox @@ -117,7 +117,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) -Note that **o365_suspicious_user_email_forwarding_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **o365_suspicious_user_email_forwarding_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ unknown | 48.0 | 80 | 60 | User $user$ configured multiple users $src_user$ with a count of $count_src_user$, a forwarding rule to same destination $ForwardingSmtpAddress$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md index 91b246d208..5a9d88a047 100644 --- a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md +++ b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md @@ -93,7 +93,7 @@ This search looks for flags passed to bcdedit.exe modifications to the built-in -#### Search +#### Search ``` @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **bcdedit_failure_recovery_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **bcdedit_failure_recovery_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +141,9 @@ Administrators may modify the boot configuration. | 80.0 | 100 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting disable the ability to recover the endpoint. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair) diff --git a/docs/_posts/2021-01-06-supernova_webshell.md b/docs/_posts/2021-01-06-supernova_webshell.md index eb14e131c0..8c445c81c2 100644 --- a/docs/_posts/2021-01-06-supernova_webshell.md +++ b/docs/_posts/2021-01-06-supernova_webshell.md @@ -16,7 +16,7 @@ tags: - Web --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -101,7 +101,7 @@ This search aims to detect the Supernova webshell used in the SUNBURST attack. -#### Search +#### Search ``` @@ -113,7 +113,8 @@ This search aims to detect the Supernova webshell used in the SUNBURST attack. The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **supernova_webshell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **supernova_webshell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ There might be false positives associted with this detection since items like ar | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.splunk.com/en_us/blog/security/detecting-supernova-malware-solarwinds-continued.html](https://www.splunk.com/en_us/blog/security/detecting-supernova-malware-solarwinds-continued.html) diff --git a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md index 2b6bfc74b4..3cd8b77e5d 100644 --- a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md +++ b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md @@ -88,7 +88,7 @@ This search provides detection of KMS keys where action kms:Encrypt is accessibl -#### Search +#### Search ``` `cloudtrail` eventName=CreateKey OR eventName=PutKeyPolicy @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ unknown | 25.0 | 50 | 50 | AWS account is potentially compromised and user $userIdentity.principalId$ is trying to compromise other accounts. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/](https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/) diff --git a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md index ddb8042f08..209a2d62bd 100644 --- a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md +++ b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md @@ -88,7 +88,7 @@ This search provides detection of users with KMS keys performing encryption spec -#### Search +#### Search ``` `cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-encryption="aws:kms" @@ -104,7 +104,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_detect_users_with_kms_keys_performing_encryption_s3_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_detect_users_with_kms_keys_performing_encryption_s3_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,6 +137,9 @@ bucket with S3 encryption | 15.0 | 30 | 50 | User $user$ with KMS keys is performing encryption, against S3 buckets on these files $dest_file$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/](https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/) diff --git a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md index 2a958c0047..0430c95f8d 100644 --- a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md +++ b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md @@ -98,7 +98,7 @@ The search looks for AWS CloudTrail events to detect if any network ACLs were cr -#### Search +#### Search ``` `cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol=-1 @@ -117,7 +117,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_network_access_control_list_created_with_all_open_ports_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_network_access_control_list_created_with_all_open_ports_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,6 +153,9 @@ It's possible that an admin has created this ACL with all ports open for some le | 48.0 | 60 | 80 | User $user_arn$ has created network ACLs with all the ports open to a specified CIDR $requestParameters.cidrBlock$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md index 767c40062f..9095ed0270 100644 --- a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md +++ b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md @@ -98,7 +98,7 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo -#### Search +#### Search ``` `cloudtrail` eventName=DeleteNetworkAclEntry requestParameters.egress=false @@ -114,7 +114,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_network_access_control_list_deleted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_network_access_control_list_deleted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ It's possible that a user has legitimately deleted a network ACL. | 5.0 | 10 | 50 | User $user_arn$ from $src$ has sucessfully deleted network ACLs entry (eventName= $eventName$), such that the instance is accessible from anywhere | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md index 9745d20186..2177b4bc10 100644 --- a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md +++ b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md @@ -94,7 +94,7 @@ The following analytic identifies microsoft.workflow.compiler.exe usage. microso -#### Search +#### Search ``` @@ -107,11 +107,12 @@ The following analytic identifies microsoft.workflow.compiler.exe usage. microso #### Macros The SPL above uses the following Macros: -* [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml) -Note that **suspicious_microsoft_workflow_compiler_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_microsoft_workflow_compiler_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,6 +149,9 @@ Although unlikely, limited instances have been identified coming from native Mic | 35.0 | 70 | 50 | Suspicious microsoft.workflow.compiler.exe process ran on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://lolbas-project.github.io/lolbas/Binaries/Msbuild/](https://lolbas-project.github.io/lolbas/Binaries/Msbuild/) diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md index 943463753c..7b65d021db 100644 --- a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md +++ b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md @@ -99,7 +99,7 @@ The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavi -#### Search +#### Search ``` @@ -112,11 +112,12 @@ The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **suspicious_msbuild_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_msbuild_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg | 42.0 | 70 | 60 | Suspicious msbuild.exe process executed on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://lolbas-project.github.io/lolbas/Binaries/Msbuild/](https://lolbas-project.github.io/lolbas/Binaries/Msbuild/) diff --git a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md index 21e98cd48e..89a76ca3e7 100644 --- a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md +++ b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md @@ -1,6 +1,6 @@ --- title: "Suspicious mshta child process" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Mshta " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-01-12 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Mshta - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ The following analytic identifies child processes spawning from "mshta.exe". Th | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | @@ -99,7 +99,7 @@ The following analytic identifies child processes spawning from "mshta.exe". Th -#### Search +#### Search ``` @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **suspicious_mshta_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_mshta_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg | 40.0 | 50 | 80 | suspicious mshta child process detected on host $dest$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/AtomicTestHarnesses](https://github.com/redcanaryco/AtomicTestHarnesses) diff --git a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md index c2066afdea..387ba5dbc3 100644 --- a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md +++ b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md @@ -99,7 +99,7 @@ Malicious actors often abuse legitimate Dynamic DNS services to host malicious p -#### Search +#### Search ``` @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [dynamic_dns_providers](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_providers.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_hosts_connecting_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_hosts_connecting_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -155,6 +156,9 @@ Some users and applications may leverage Dynamic DNS to reach out to some domain | 56.0 | 70 | 80 | A dns query $query$ from your infra connecting to suspicious domain in host $host$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md index 5cbf7b96a7..bd9b84ac59 100644 --- a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md +++ b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md @@ -103,7 +103,7 @@ This search looks for PowerShell processes launched with arguments that have cha -#### Search +#### Search ``` @@ -122,7 +122,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -Note that **malicious_powershell_process_with_obfuscation_techniques_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **malicious_powershell_process_with_obfuscation_techniques_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -159,6 +160,9 @@ These characters might be legitimately on the command-line, but it is not common | 42.0 | 70 | 60 | Powershell.exe running with potential obfuscated arguments on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md b/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md index dd7f60033a..619fc4e86f 100644 --- a/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md +++ b/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md @@ -98,7 +98,7 @@ This search looks for PowerShell processes started with a base64 encoded command -#### Search +#### Search ``` @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **suspicious_powershell_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_powershell_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ Legitimate process can have this combination of command-line options, but it's n | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md index 7689616c36..47d043c3a9 100644 --- a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md +++ b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md @@ -1,6 +1,6 @@ --- title: "Detect Rundll32 Inline HTA Execution" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Mshta " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-01-20 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Mshta - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ The following analytic identifies "rundll32.exe" execution with inline protocol | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | @@ -99,7 +99,7 @@ The following analytic identifies "rundll32.exe" execution with inline protocol -#### Search +#### Search ``` @@ -112,11 +112,12 @@ The following analytic identifies "rundll32.exe" execution with inline protocol #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -Note that **detect_rundll32_inline_hta_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_rundll32_inline_hta_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -154,6 +155,9 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg | 56.0 | 70 | 80 | Suspicious rundll32.exe inline HTA execution on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/AtomicTestHarnesses](https://github.com/redcanaryco/AtomicTestHarnesses) diff --git a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md index 88cbddce22..d0b312eb27 100644 --- a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md +++ b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md @@ -1,6 +1,6 @@ --- title: "Suspicious mshta spawn" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Mshta " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-01-20 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Mshta - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | @@ -99,7 +99,7 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior -#### Search +#### Search ``` @@ -112,11 +112,12 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior #### Macros The SPL above uses the following Macros: -* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) -Note that **suspicious_mshta_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_mshta_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg | 42.0 | 70 | 60 | mshta.exe spawned by wmiprvse.exe on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://codewhitesec.blogspot.com/2018/07/lethalhta.html](https://codewhitesec.blogspot.com/2018/07/lethalhta.html) diff --git a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md index 966ed9301b..d664d5b08b 100644 --- a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md +++ b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md @@ -93,7 +93,7 @@ This search looks for flags passed to wbadmin.exe (Windows Backup Administrator -#### Search +#### Search ``` @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **wbadmin_delete_system_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **wbadmin_delete_system_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +141,9 @@ Administrators may modify the boot configuration. | 15.0 | 30 | 50 | System backups deletion on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md) diff --git a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md index 0e4e1bf050..846b13e051 100644 --- a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md +++ b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md @@ -91,7 +91,7 @@ This search provides specific SAML access from specific Service Provider, user a -#### Search +#### Search ``` `cloudtrail` eventName=Assumerolewithsaml @@ -106,7 +106,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_saml_access_by_provider_user_and_principal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_saml_access_by_provider_user_and_principal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very diff | 64.0 | 80 | 80 | From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for account ID $recipientAccountId$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://us-cert.cisa.gov/ncas/alerts/aa21-008a](https://us-cert.cisa.gov/ncas/alerts/aa21-008a) diff --git a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md index b0f41695ce..dc5e47487f 100644 --- a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md +++ b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md @@ -91,7 +91,7 @@ This search provides detection of updates to SAML provider in AWS. Updates to SA -#### Search +#### Search ``` `cloudtrail` eventName=UpdateSAMLProvider @@ -106,7 +106,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_saml_update_identity_provider_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_saml_update_identity_provider_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ Updating a SAML provider or creating a new one may not necessarily be malicious | 64.0 | 80 | 80 | User $userIdentity.principalId$ from IP address $sourceIPAddress$ has trigged an event $eventName$ to update the SAML provider to $requestParameters.sAMLProviderArn$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://us-cert.cisa.gov/ncas/alerts/aa21-008a](https://us-cert.cisa.gov/ncas/alerts/aa21-008a) diff --git a/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md b/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md index a23334102b..36d2feefe0 100644 --- a/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md +++ b/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md @@ -81,7 +81,7 @@ This search looks for arguments to certutil.exe indicating the manipulation or e -#### Search +#### Search ``` @@ -96,7 +96,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **certutil_exe_certificate_extraction_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **certutil_exe_certificate_extraction_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,6 +135,9 @@ Unless there are specific use cases, manipulating or exporting certificates usin | 63.0 | 90 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting export a certificate. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md index 471fe73ca8..aea83fb679 100644 --- a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md +++ b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md @@ -84,7 +84,7 @@ This search looks for a spike in number of of AWS security Hub alerts for an EC2 -#### Search +#### Search ``` `aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance @@ -102,7 +102,8 @@ This search looks for a spike in number of of AWS security Hub alerts for an EC2 The SPL above uses the following Macros: * [aws_securityhub_finding](https://github.com/splunk/security_content/blob/develop/macros/aws_securityhub_finding.yml) -Note that **detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,6 +135,9 @@ None | 15.0 | 30 | 50 | Spike in AWS security Hub alerts with title $Title$ for EC2 instance $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md index 33fe7b4b24..dcbb62614f 100644 --- a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md +++ b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md @@ -12,7 +12,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -87,7 +87,7 @@ This search looks for a spike in number of of AWS security Hub alerts for an AWS -#### Search +#### Search ``` `aws_securityhub_finding` "findings{}.Resources{}.Type"= AwsIamUser @@ -106,7 +106,8 @@ This search looks for a spike in number of of AWS security Hub alerts for an AWS The SPL above uses the following Macros: * [aws_securityhub_finding](https://github.com/splunk/security_content/blob/develop/macros/aws_securityhub_finding.yml) -Note that **detect_spike_in_aws_security_hub_alerts_for_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_spike_in_aws_security_hub_alerts_for_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,6 +135,9 @@ None | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md b/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md index ee0075faf1..56115e9a35 100644 --- a/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md +++ b/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md @@ -93,7 +93,7 @@ This search detects the creation of a new Federation setting by alerting about a -#### Search +#### Search ``` `o365_management_activity` Workload=AzureActiveDirectory Operation="Add app role assignment grant to user." @@ -108,7 +108,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) -Note that **o365_add_app_role_assignment_grant_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **o365_add_app_role_assignment_grant_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ The creation of a new Federation is not necessarily malicious, however this even | 18.0 | 30 | 60 | User $Actor.ID$ has created a new federation setting on $dest$ from IP Address $ActorIpAddress$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf](https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf) diff --git a/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md b/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md index 3760e18a4e..d4d8226a87 100644 --- a/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md +++ b/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md @@ -90,7 +90,7 @@ This search detects accounts with high number of Single Sign ON (SSO) logon erro -#### Search +#### Search ``` `o365_management_activity` Workload=AzureActiveDirectory LogonError=SsoArtifactInvalidOrExpired @@ -106,7 +106,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) -Note that **o365_excessive_sso_logon_errors_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **o365_excessive_sso_logon_errors_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ Logon errors may not be malicious in nature however it may indicate attempts to | 64.0 | 80 | 80 | User $UserId$ has caused excessive number of SSO logon errors from $ActorIpAddress$ using UserAgent $UserAgent$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://stealthbits.com/blog/bypassing-mfa-with-pass-the-cookie/](https://stealthbits.com/blog/bypassing-mfa-with-pass-the-cookie/) diff --git a/docs/_posts/2021-01-26-o365_new_federated_domain_added.md b/docs/_posts/2021-01-26-o365_new_federated_domain_added.md index 1a49280efa..7f5a999c57 100644 --- a/docs/_posts/2021-01-26-o365_new_federated_domain_added.md +++ b/docs/_posts/2021-01-26-o365_new_federated_domain_added.md @@ -93,7 +93,7 @@ This search detects the addition of a new Federated domain. -#### Search +#### Search ``` `o365_management_activity` Workload=Exchange Operation="Add-FederatedDomain" @@ -108,7 +108,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) -Note that **o365_new_federated_domain_added_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **o365_new_federated_domain_added_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ The creation of a new Federated domain is not necessarily malicious, however the | 64.0 | 80 | 80 | User $UserId$ has added a new federated domaain $Parameters.Value$ for $OrganizationName$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf](https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf) diff --git a/docs/_posts/2021-01-26-revil_registry_entry.md b/docs/_posts/2021-01-26-revil_registry_entry.md index a1f5ec5cb7..4f0943db57 100644 --- a/docs/_posts/2021-01-26-revil_registry_entry.md +++ b/docs/_posts/2021-01-26-revil_registry_entry.md @@ -89,7 +89,7 @@ This analytic identifies suspicious modification in registry entry to keep some -#### Search +#### Search ``` @@ -109,7 +109,8 @@ This analytic identifies suspicious modification in registry entry to keep some The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **revil_registry_entry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **revil_registry_entry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ unknown | 60.0 | 60 | 100 | A registry entry $registry_path$ with registry value $registry_value_name$ and $registry_value_name$ related to revil ransomware in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/](https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/) diff --git a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md index b6d7196f47..1a8eb1b0ec 100644 --- a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md +++ b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md @@ -16,7 +16,7 @@ tags: - CVE-2021-3156 --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -101,7 +101,7 @@ This search detects the heap-based buffer overflow of sudoedit -#### Search +#### Search ``` `linux_hosts` @@ -113,7 +113,8 @@ This search detects the heap-based buffer overflow of sudoedit The SPL above uses the following Macros: * [linux_hosts](https://github.com/splunk/security_content/blob/develop/macros/linux_hosts.yml) -Note that **detect_baron_samedit_cve-2021-3156_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_baron_samedit_cve-2021-3156_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ unknown | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md index 23f23aa231..8133d978f0 100644 --- a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md +++ b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md @@ -16,7 +16,7 @@ tags: - CVE-2021-3156 --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -101,7 +101,7 @@ This search detects the heap-based buffer overflow of sudoedit -#### Search +#### Search ``` `osquery_process` @@ -113,7 +113,8 @@ This search detects the heap-based buffer overflow of sudoedit The SPL above uses the following Macros: * [osquery_process](https://github.com/splunk/security_content/blob/develop/macros/osquery_process.yml) -Note that **detect_baron_samedit_cve-2021-3156_via_osquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_baron_samedit_cve-2021-3156_via_osquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ unknown | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md index 0972b4cc18..439fe38455 100644 --- a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md +++ b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md @@ -1,6 +1,6 @@ --- title: "Detect Regsvr32 Application Control Bypass" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Regsvr32 " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-01-28 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Regsvr32 - Defense Evasion - Defense Evasion @@ -46,7 +46,7 @@ Upon investigating, look for network connections to remote destinations (interna | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.010](https://attack.mitre.org/techniques/T1218/010/) | Regsvr32 | Defense Evasion | @@ -100,7 +100,7 @@ Upon investigating, look for network connections to remote destinations (interna -#### Search +#### Search ``` @@ -117,7 +117,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) -Note that **detect_regsvr32_application_control_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_regsvr32_application_control_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -155,6 +156,9 @@ Limited false positives related to third party software registering .DLL's. | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ in an attempt to bypass detection and preventative controls was identified on endpoint $dest$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1218/010/](https://attack.mitre.org/techniques/T1218/010/) diff --git a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md index d0774cca2f..fe50788ea2 100644 --- a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md +++ b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md @@ -101,7 +101,7 @@ This technique uses "Install from Media" (IFM), which will extract a copy of the -#### Search +#### Search ``` @@ -117,7 +117,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **ntdsutil_export_ntds_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **ntdsutil_export_ntds_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ Highly possible Server Administrators will troubleshoot with ntdsutil.exe, gener | 50.0 | 100 | 50 | Active Directory NTDS export on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil) diff --git a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md index fb0a31ce9d..e359d35b62 100644 --- a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md +++ b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md @@ -1,6 +1,6 @@ --- title: "Suspicious Regsvr32 Register Suspicious Path" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Regsvr32 " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-01-28 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Regsvr32 - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.010](https://attack.mitre.org/techniques/T1218/010/) | Regsvr32 | Defense Evasion | @@ -99,7 +99,7 @@ Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using -#### Search +#### Search ``` @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) -Note that **suspicious_regsvr32_register_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_regsvr32_register_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -154,6 +155,9 @@ Limited false positives with the query restricted to specified paths. Add more w | 35.0 | 70 | 50 | Suspicious $Processes.process_path.file_path$ process potentially loading malicious code | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1218/010/](https://attack.mitre.org/techniques/T1218/010/) diff --git a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md index b9e2165474..fec5bc362c 100644 --- a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md +++ b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md @@ -16,7 +16,7 @@ tags: - CVE-2021-3156 --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -101,7 +101,7 @@ This search detects the heap-based buffer overflow of sudoedit -#### Search +#### Search ``` `linux_hosts` @@ -115,7 +115,8 @@ This search detects the heap-based buffer overflow of sudoedit The SPL above uses the following Macros: * [linux_hosts](https://github.com/splunk/security_content/blob/develop/macros/linux_hosts.yml) -Note that **detect_baron_samedit_cve-2021-3156_segfault_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_baron_samedit_cve-2021-3156_segfault_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ If sudoedit is throwing segfaults for other reasons this will pick those up too. | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md index 686b1e294e..9f386c5152 100644 --- a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md +++ b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md @@ -95,7 +95,7 @@ During triage, confirm this is procdump.exe executing. If it is the first time a -#### Search +#### Search ``` `sysmon` OriginalFileName=procdump process_name!=procdump*.exe EventID=1 (CommandLine=*-ma* OR CommandLine=*-mm*) CommandLine=*lsass* @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **dump_lsass_via_procdump_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **dump_lsass_via_procdump_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ None identified. | 80.0 | 80 | 100 | The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$, attempting to dump lsass.exe. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1003/001/](https://attack.mitre.org/techniques/T1003/001/) diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md index c03d864171..acc307e278 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md @@ -1,6 +1,6 @@ --- title: "Detect Rundll32 Application Control Bypass - advpack" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Rundll32 " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-02-04 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Rundll32 - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | @@ -99,7 +99,7 @@ The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack -#### Search +#### Search ``` @@ -112,11 +112,12 @@ The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -Note that **detect_rundll32_application_control_bypass_-_advpack_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_rundll32_application_control_bypass_-_advpack_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ Although unlikely, some legitimate applications may use advpack.dll or ieadvpack | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/) diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md index 904afa7036..7bc5cca6f8 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md @@ -1,6 +1,6 @@ --- title: "Detect Rundll32 Application Control Bypass - setupapi" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Rundll32 " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-02-04 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Rundll32 - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ The following analytic identifies rundll32.exe loading setupapi.dll and iesetupa | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | @@ -99,7 +99,7 @@ The following analytic identifies rundll32.exe loading setupapi.dll and iesetupa -#### Search +#### Search ``` @@ -112,11 +112,12 @@ The following analytic identifies rundll32.exe loading setupapi.dll and iesetupa #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -Note that **detect_rundll32_application_control_bypass_-_setupapi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_rundll32_application_control_bypass_-_setupapi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ Although unlikely, some legitimate applications may use setupapi triggering a fa | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/) diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md index 464dd34ee2..3a816b2d7a 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md @@ -1,6 +1,6 @@ --- title: "Detect Rundll32 Application Control Bypass - syssetup" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Rundll32 " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-02-04 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Rundll32 - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ The following analytic identifies rundll32.exe loading syssetup.dll by calling t | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | @@ -99,7 +99,7 @@ The following analytic identifies rundll32.exe loading syssetup.dll by calling t -#### Search +#### Search ``` @@ -112,11 +112,12 @@ The following analytic identifies rundll32.exe loading syssetup.dll by calling t #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -Note that **detect_rundll32_application_control_bypass_-_syssetup_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_rundll32_application_control_bypass_-_syssetup_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ Although unlikely, some legitimate applications may use syssetup.dll, triggering | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ loading syssetup.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/) diff --git a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md index adf243256a..96be9a47d6 100644 --- a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md +++ b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md @@ -1,6 +1,6 @@ --- title: "Suspicious Rundll32 StartW" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Rundll32 " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-02-04 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Rundll32 - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ The following analytic identifies rundll32.exe executing a DLL function name, St | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | @@ -99,7 +99,7 @@ The following analytic identifies rundll32.exe executing a DLL function name, St -#### Search +#### Search ``` @@ -112,11 +112,12 @@ The following analytic identifies rundll32.exe executing a DLL function name, St #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -Note that **suspicious_rundll32_startw_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_rundll32_startw_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -154,6 +155,9 @@ Although unlikely, some legitimate applications may use Start as a function and | 35.0 | 70 | 50 | rundll32.exe running with suspicious parameters on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/) diff --git a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md index a73bb507bf..04f2adfb93 100644 --- a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md +++ b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md @@ -1,6 +1,6 @@ --- title: "Suspicious Rundll32 dllregisterserver" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Rundll32 " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-02-09 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Rundll32 - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ The following analytic identifies rundll32.exe using dllregisterserver on the co | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | @@ -99,7 +99,7 @@ The following analytic identifies rundll32.exe using dllregisterserver on the co -#### Search +#### Search ``` @@ -112,11 +112,12 @@ The following analytic identifies rundll32.exe using dllregisterserver on the co #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -Note that **suspicious_rundll32_dllregisterserver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_rundll32_dllregisterserver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ This is likely to produce false positives and will require some filtering. Tune | 35.0 | 70 | 50 | $Processes.process_path.file_path$ process potentially loading malicious code | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/) diff --git a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md index f14948b5f5..159f8fa6d9 100644 --- a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md +++ b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md @@ -1,6 +1,6 @@ --- title: "Detect HTML Help Spawn Child Process" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Compiled HTML File " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-02-11 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Compiled HTML File - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.001](https://attack.mitre.org/techniques/T1218/001/) | Compiled HTML File | Defense Evasion | @@ -99,7 +99,7 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM -#### Search +#### Search ``` @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_html_help_spawn_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_html_help_spawn_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,6 +153,9 @@ Although unlikely, some legitimate applications (ex. web browsers) may spawn a c | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1218/001/](https://attack.mitre.org/techniques/T1218/001/) diff --git a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md index 278ef967b2..9d0ebf91bf 100644 --- a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md +++ b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md @@ -1,6 +1,6 @@ --- title: "Detect Regasm Spawning a Process" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Regsvcs/Regasm " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-02-12 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Regsvcs/Regasm - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ The following analytic identifies regasm.exe spawning a process. This particular | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion | @@ -99,7 +99,7 @@ The following analytic identifies regasm.exe spawning a process. This particular -#### Search +#### Search ``` @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_regasm_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_regasm_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,6 +149,9 @@ Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a fa | 64.0 | 80 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior for $parent_process_name$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1218/009/](https://attack.mitre.org/techniques/T1218/009/) diff --git a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md index 97fbe7c45d..2a8a379e62 100644 --- a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md +++ b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md @@ -1,6 +1,6 @@ --- title: "Detect Regsvcs Spawning a Process" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Regsvcs/Regasm " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-02-12 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Regsvcs/Regasm - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ The following analytic identifies regsvcs.exe spawning a process. This particula | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion | @@ -99,7 +99,7 @@ The following analytic identifies regsvcs.exe spawning a process. This particula -#### Search +#### Search ``` @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_regsvcs_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_regsvcs_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a fa | 64.0 | 80 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ typically not normal for this process. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1218/009/](https://attack.mitre.org/techniques/T1218/009/) diff --git a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md index e5ba4bb209..dbdcf8ff4e 100644 --- a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md +++ b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md @@ -16,7 +16,7 @@ tags: - Endpoint --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -91,7 +91,7 @@ The following analytic identifies the use of a curl contacting suspicious remote -#### Search +#### Search ``` @@ -107,7 +107,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **suspicious_curl_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_curl_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +141,9 @@ Unknown. Filter as needed. | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://redcanary.com/blog/clipping-silver-sparrows-wings/](https://redcanary.com/blog/clipping-silver-sparrows-wings/) diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md index f9884c8214..5de2b256eb 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md @@ -21,7 +21,7 @@ tags: - Endpoint --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -105,7 +105,7 @@ Upon triage, capture the property list file being written to disk and review for -#### Search +#### Search ``` @@ -121,7 +121,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **suspicious_plistbuddy_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_plistbuddy_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ Some legitimate applications may use PlistBuddy to create or modify property lis | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://marcosantadev.com/manage-plist-files-plistbuddy/](https://marcosantadev.com/manage-plist-files-plistbuddy/) diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md index fc34668e91..974e87cf8e 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md @@ -20,7 +20,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -104,7 +104,7 @@ Upon triage, capture the property list file being written to disk and review for -#### Search +#### Search ``` `osquery_process` "columns.cmdline"="*LaunchAgents*" OR "columns.cmdline"="*RunAtLoad*" OR "columns.cmdline"="*true*" @@ -115,7 +115,8 @@ Upon triage, capture the property list file being written to disk and review for The SPL above uses the following Macros: * [osquery_process](https://github.com/splunk/security_content/blob/develop/macros/osquery_process.yml) -Note that **suspicious_plistbuddy_usage_via_osquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_plistbuddy_usage_via_osquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ Some legitimate applications may use PlistBuddy to create or modify property lis | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://marcosantadev.com/manage-plist-files-plistbuddy/](https://marcosantadev.com/manage-plist-files-plistbuddy/) diff --git a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md index 39645819cc..e6a1970067 100644 --- a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md +++ b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md @@ -16,7 +16,7 @@ tags: - Endpoint --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -91,7 +91,7 @@ The following analytic identifies the use of a SQLite3 querying the MacOS prefer -#### Search +#### Search ``` @@ -107,7 +107,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **suspicious_sqlite3_lsquarantine_behavior_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_sqlite3_lsquarantine_behavior_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ Unknown. | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://redcanary.com/blog/clipping-silver-sparrows-wings/](https://redcanary.com/blog/clipping-silver-sparrows-wings/) diff --git a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md index 30ec8a239c..91529dda7f 100644 --- a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md +++ b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md @@ -105,7 +105,7 @@ Upon triage, fodhelper.exe will have a child process and read access will occur -#### Search +#### Search ``` @@ -121,7 +121,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **fodhelper_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **fodhelper_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -155,6 +156,9 @@ Limited to no false positives are expected. | 81.0 | 90 | 90 | Suspcious registy keys added by process fodhelper.exe (process_id- $process_id), with a parent_process of $parent_process_name$ that has been executed on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/](https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/) diff --git a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md index 48736192fd..dece70ff7a 100644 --- a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md +++ b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md @@ -94,7 +94,7 @@ This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware. -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **ryuk_wake_on_lan_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **ryuk_wake_on_lan_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ Limited to no known false positives. | 63.0 | 70 | 90 | A process $process_name$ with wake on LAN commandline $process$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/](https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/) diff --git a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md index f89bc90801..eb556f5990 100644 --- a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md +++ b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md @@ -98,7 +98,7 @@ The following detection identifies Scheduled Tasks registering (creating a new t -#### Search +#### Search ``` @@ -114,7 +114,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **suspicious_scheduled_task_from_public_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_scheduled_task_from_public_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,6 +151,9 @@ Limited false positives may be present. Filter as needed by parent process or co | 35.0 | 70 | 50 | Suspicious scheduled task registered on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1053/005/](https://attack.mitre.org/techniques/T1053/005/) diff --git a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md index 44f21db37c..b76b821b3b 100644 --- a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md +++ b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md @@ -105,7 +105,7 @@ This search looks for AWS CloudTrail events where a user has set a default polic -#### Search +#### Search ``` `cloudtrail` eventName=SetDefaultPolicyVersion eventSource = iam.amazonaws.com @@ -120,7 +120,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_setdefaultpolicyversion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_setdefaultpolicyversion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,6 +151,9 @@ While this search has no known false positives, it is possible that an AWS admin | 30.0 | 50 | 60 | From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for updating the the default policy version | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws](https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws) diff --git a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md index 2b5e8d2b43..0ec3fb86c5 100644 --- a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md +++ b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md @@ -94,7 +94,7 @@ This detection identifies Microsoft Exchange Server's Unified Messaging services -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **unified_messaging_service_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **unified_messaging_service_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ Unknown. Tune out child processes as needed to limit volume of false positives. | 56.0 | 70 | 80 | Possible CVE-2021-26857 exploitation on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/](https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/) diff --git a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md index e73e6c641e..688415c8ab 100644 --- a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md +++ b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md @@ -99,7 +99,7 @@ The search looks for the Registry Key DisableAntiSpyware set to disable. This is -#### Search +#### Search ``` @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_disableantispyware_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_disableantispyware_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ It is unusual to turn this feature off a Windows system since it is a default se | 24.0 | 30 | 80 | Windows DisableAntiSpyware registry key set to 'disabled' on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/](https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/) diff --git a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md index cf755cc8bf..d0e7a912b1 100644 --- a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md +++ b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md @@ -94,7 +94,7 @@ This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -Note that **nishang_powershelltcponeline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **nishang_powershelltcponeline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ Limited false positives may be present. Filter as needed based on initial analys | 42.0 | 70 | 60 | Possible Nishang Invoke-PowerShellTCPOneLine behavior on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1](https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1) diff --git a/docs/_posts/2021-03-03-w3wp_spawning_shell.md b/docs/_posts/2021-03-03-w3wp_spawning_shell.md index c87e937f29..6726c5d15f 100644 --- a/docs/_posts/2021-03-03-w3wp_spawning_shell.md +++ b/docs/_posts/2021-03-03-w3wp_spawning_shell.md @@ -103,7 +103,7 @@ This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe -#### Search +#### Search ``` @@ -116,12 +116,13 @@ This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -Note that **w3wp_spawning_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **w3wp_spawning_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -159,6 +160,9 @@ Baseline your environment before production. It is possible build systems using | 56.0 | 70 | 80 | Possible Web Shell execution on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/](https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/) diff --git a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md index 0e3389bbfc..7aab4e59f6 100644 --- a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md +++ b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md @@ -89,7 +89,7 @@ The following analytics identifies a big number of instance of ransomware notes -#### Search +#### Search ``` `sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") @@ -106,7 +106,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **ransomware_notes_bulk_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **ransomware_notes_bulk_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * EventCode @@ -139,6 +140,9 @@ unknown | 81.0 | 90 | 90 | A high frequency file creation of $file_name$ in different file path in host $Computer$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html](https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html) diff --git a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md index 0a7600a4dc..25fcd9d035 100644 --- a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md +++ b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md @@ -89,7 +89,7 @@ The following analytics identifies the resizing of shadowstorage by ransomware m -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **resize_shadowstorage_volume_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **resize_shadowstorage_volume_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.process @@ -136,6 +137,9 @@ network admin can resize the shadowstorage for valid purposes. | 72.0 | 80 | 90 | A process $parent_process_name$ attempt to resize shadow copy with commandline $process$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html](https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html) diff --git a/docs/_posts/2021-03-16-high_process_termination_frequency.md b/docs/_posts/2021-03-16-high_process_termination_frequency.md index 76bf9da0e6..7e163a984d 100644 --- a/docs/_posts/2021-03-16-high_process_termination_frequency.md +++ b/docs/_posts/2021-03-16-high_process_termination_frequency.md @@ -89,7 +89,7 @@ This analytics are designed to indentify a high frequency of process termination -#### Search +#### Search ``` `sysmon` EventCode=5 @@ -106,7 +106,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **high_process_termination_frequency_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **high_process_termination_frequency_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * EventCode @@ -135,6 +136,9 @@ admin or user tool that can terminate multiple process. | 72.0 | 90 | 80 | High frequency process termination (more than 15 processes within 3s) detected on host $Computer$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html](https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html) diff --git a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md index 708d0ea7d0..f0c1bee681 100644 --- a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md +++ b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md @@ -89,7 +89,7 @@ This search looks for high frequency of file deletion relative to process name a -#### Search +#### Search ``` `sysmon` EventCode=23 TargetFilename IN ("*.cmd", "*.ini","*.gif", "*.jpg", "*.jpeg", "*.db", "*.ps1", "*.doc*", "*.xls*", "*.ppt*", "*.bmp","*.zip", "*.rar", "*.7z", "*.chm", "*.png", "*.log", "*.vbs", "*.js", "*.vhd", "*.bak", "*.wbcat", "*.bkf" , "*.backup*", "*.dsk", , "*.win") @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **windows_high_file_deletion_frequency_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_high_file_deletion_frequency_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * EventCode @@ -137,6 +138,9 @@ user may delete bunch of pictures or files in a folder. | 72.0 | 90 | 80 | High frequency file deletion activity detected on host $Computer$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html](https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html) diff --git a/docs/_posts/2021-03-17-clop_common_exec_parameter.md b/docs/_posts/2021-03-17-clop_common_exec_parameter.md index e5ee67acab..ea8d3860ef 100644 --- a/docs/_posts/2021-03-17-clop_common_exec_parameter.md +++ b/docs/_posts/2021-03-17-clop_common_exec_parameter.md @@ -89,7 +89,7 @@ The following analytics are designed to identifies some CLOP ransomware variant -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **clop_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **clop_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ Operators can execute third party tools using these parameters. | 100.0 | 100 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting using arguments to execute its main code or feature of its code related to Clop ransomware. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html](https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html) diff --git a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md index a63075cca6..ef67d8a565 100644 --- a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md +++ b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md @@ -90,7 +90,7 @@ This detection is to identify the common service name created by the CLOP ransom -#### Search +#### Search ``` `wineventlog_system` EventCode=7045 Service_Name IN ("SecurityCenterIBM", "WinCheckDRVs") @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) -Note that **clop_ransomware_known_service_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **clop_ransomware_known_service_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * EventCode @@ -136,6 +137,9 @@ unknown | 100.0 | 100 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ executing known Clop Ransomware service names. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html](https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html) diff --git a/docs/_posts/2021-03-23-certutil_with_decode_argument.md b/docs/_posts/2021-03-23-certutil_with_decode_argument.md index f99d1d3ac0..b296aab454 100644 --- a/docs/_posts/2021-03-23-certutil_with_decode_argument.md +++ b/docs/_posts/2021-03-23-certutil_with_decode_argument.md @@ -89,7 +89,7 @@ CertUtil.exe may be used to `encode` and `decode` a file, including PE and scrip -#### Search +#### Search ``` @@ -106,7 +106,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **certutil_with_decode_argument_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **certutil_with_decode_argument_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ Typically seen used to `encode` files, but it is possible to see legitimate use | 40.0 | 50 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to decode a file. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1140/](https://attack.mitre.org/techniques/T1140/) diff --git a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md index e3a299456b..13954c7f7a 100644 --- a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md +++ b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md @@ -90,7 +90,7 @@ Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functio -#### Search +#### Search ``` @@ -107,7 +107,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -Note that **powershell_start-bitstransfer_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **powershell_start-bitstransfer_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ Limited false positives. It is possible administrators will utilize Start-BitsTr | 56.0 | 70 | 80 | A suspicious process $process_name$ with commandline $process$ that are related to bittransfer functionality in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281](https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281) diff --git a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md index 1ab674bd22..cd57330b12 100644 --- a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md +++ b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md @@ -98,7 +98,7 @@ The following query uses IAM events to track the success of a group being delete -#### Search +#### Search ``` `cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode=success (userAgent!=*.amazonaws.com) @@ -113,7 +113,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_iam_successful_group_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_iam_successful_group_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ This detection will require tuning to provide high fidelity detection capabiltie | 5.0 | 10 | 50 | User $user_arn$ has sucessfully deleted mulitple groups $group_deleted$ from $src$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html) diff --git a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md index 43669b7e0f..59afd63e06 100644 --- a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md +++ b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md @@ -94,7 +94,7 @@ This search is to identifies suspicious firewall disabling using netsh applicati -#### Search +#### Search ``` @@ -108,10 +108,11 @@ This search is to identifies suspicious firewall disabling using netsh applicati #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **disabling_firewall_with_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disabling_firewall_with_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ admin may disable firewall during testing or fixing network problem. | 25.0 | 50 | 50 | The Windows Firewall was disabled on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.htm](https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.htm) diff --git a/docs/_posts/2021-03-31-dsquery_domain_discovery.md b/docs/_posts/2021-03-31-dsquery_domain_discovery.md index d64e8870d5..b7f2076a28 100644 --- a/docs/_posts/2021-03-31-dsquery_domain_discovery.md +++ b/docs/_posts/2021-03-31-dsquery_domain_discovery.md @@ -94,7 +94,7 @@ In addition to trust discovery, review parallel processes for additional behavio -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **dsquery_domain_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **dsquery_domain_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ Limited false positives. If there is a true false positive, filter based on comm | 72.0 | 80 | 90 | An instance of $parent_process_name$ spawning $process_name$ was identified performing domain discovery on endpoint $dest$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md) diff --git a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md index 86681a6302..580660d873 100644 --- a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md +++ b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md @@ -93,7 +93,7 @@ The following detection identifies any malformed policy document exceptions with -#### Search +#### Search ``` `cloudtrail` (errorCode=MalformedPolicyDocumentException) status=failure (userAgent!=*.amazonaws.com) @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_iam_assume_role_policy_brute_force_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_iam_assume_role_policy_brute_force_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ This detection will require tuning to provide high fidelity detection capabiltie | 28.0 | 40 | 70 | User $user_arn$ has caused multiple failures with errorCode $errorCode$, which potentially means adversary is attempting to identify a role name. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities](https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities) diff --git a/docs/_posts/2021-04-01-aws_iam_delete_policy.md b/docs/_posts/2021-04-01-aws_iam_delete_policy.md index 3825de3e6d..da5efa4654 100644 --- a/docs/_posts/2021-04-01-aws_iam_delete_policy.md +++ b/docs/_posts/2021-04-01-aws_iam_delete_policy.md @@ -88,7 +88,7 @@ The following detection identifes when a policy is deleted on AWS. This does not -#### Search +#### Search ``` `cloudtrail` eventName=DeletePolicy (userAgent!=*.amazonaws.com) @@ -103,7 +103,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_iam_delete_policy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_iam_delete_policy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,6 +133,9 @@ This detection will require tuning to provide high fidelity detection capabiltie | 10.0 | 20 | 50 | User $user_arn$ has deleted AWS Policies from IP address $src$ by executing the following command $eventName$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeletePolicy.html](https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeletePolicy.html) diff --git a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md index 3841f34703..9df4f77462 100644 --- a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md +++ b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md @@ -88,7 +88,7 @@ This detection identifies failure attempts to delete groups. We want to identify -#### Search +#### Search ``` `cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode IN (NoSuchEntityException,DeleteConflictException, AccessDenied) (userAgent!=*.amazonaws.com) @@ -103,7 +103,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_iam_failure_group_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_iam_failure_group_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,6 +133,9 @@ This detection will require tuning to provide high fidelity detection capabiltie | 5.0 | 10 | 50 | User $user_arn$ has had mulitple failures while attempting to delete groups from $src$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html) diff --git a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md index 93e3d3e483..81f481835a 100644 --- a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md +++ b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md @@ -94,7 +94,7 @@ This detection is to identify the abuse the Windows SC.exe to execute malicious -#### Search +#### Search ``` `wineventlog_system` EventCode=7045 @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) -Note that **malicious_powershell_executed_as_a_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **malicious_powershell_executed_as_a_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * EventCode @@ -150,6 +151,9 @@ Creating a hidden powershell service is rare and could key off of those instance | 72.0 | 90 | 80 | Identifies the abuse the Windows SC.exe to execute malicious powerShell as a service $Service_File_Name$ by $user$ on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf](https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf) diff --git a/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md b/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md index 28e354d369..907634a468 100644 --- a/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md +++ b/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md @@ -96,7 +96,7 @@ The analytics returned fields allow analysts to investigate the event further by -#### Search +#### Search ``` `wineventlog_security` EventCode=4771 Failure_Code=0x18 Account_Name!="*$" @@ -113,7 +113,8 @@ The analytics returned fields allow analysts to investigate the event further by The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **multiple_users_failing_to_authenticate_from_host_using_kerberos_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **multiple_users_failing_to_authenticate_from_host_using_kerberos_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ A host failing to authenticate with multiple valid domain users is not a common | 49.0 | 70 | 70 | Potential Kerberos based password spraying attack from $Client_Address$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/) diff --git a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md index b1e9e453eb..b793ff6484 100644 --- a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md +++ b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md @@ -101,7 +101,7 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or was it v -#### Search +#### Search ``` `wineventlog_security` EventCode=4698 @@ -115,10 +115,11 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or was it v #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **winevent_scheduled_task_created_within_public_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **winevent_scheduled_task_created_within_public_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,6 +153,9 @@ False positives are possible if legitimate applications are allowed to register | 70.0 | 70 | 100 | A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/](https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/) diff --git a/docs/_posts/2021-04-12-excel_spawning_powershell.md b/docs/_posts/2021-04-12-excel_spawning_powershell.md index 9057ad8f70..520f69b738 100644 --- a/docs/_posts/2021-04-12-excel_spawning_powershell.md +++ b/docs/_posts/2021-04-12-excel_spawning_powershell.md @@ -94,7 +94,7 @@ The following detection identifies Microsoft Excel spawning PowerShell. Typicall -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -Note that **excel_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **excel_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -146,6 +147,9 @@ False positives should be limited, but if any are present, filter as needed. | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://redcanary.com/threat-detection-report/techniques/powershell/](https://redcanary.com/threat-detection-report/techniques/powershell/) diff --git a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md index ff9539316e..a8ca11ee8d 100644 --- a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md +++ b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md @@ -94,7 +94,7 @@ The following detection identifies Microsoft Excel spawning Windows Script Host -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **excel_spawning_windows_script_host_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **excel_spawning_windows_script_host_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ False positives should be limited, but if any are present, filter as needed. In | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://app.any.run/tasks/8ecfbc29-03d0-421c-a5bf-3905d29192a2/](https://app.any.run/tasks/8ecfbc29-03d0-421c-a5bf-3905d29192a2/) diff --git a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md index 81a1afef38..680f07d746 100644 --- a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md +++ b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md @@ -101,7 +101,7 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or via Task -#### Search +#### Search ``` `wineventlog_security` EventCode=4698 @@ -115,10 +115,11 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or via Task #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **winevent_scheduled_task_created_to_spawn_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **winevent_scheduled_task_created_to_spawn_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ False positives are possible if legitimate applications are allowed to register | 70.0 | 70 | 100 | A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/](https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/) diff --git a/docs/_posts/2021-04-12-winword_spawning_powershell.md b/docs/_posts/2021-04-12-winword_spawning_powershell.md index a827c636c9..4c34800f99 100644 --- a/docs/_posts/2021-04-12-winword_spawning_powershell.md +++ b/docs/_posts/2021-04-12-winword_spawning_powershell.md @@ -94,7 +94,7 @@ The following detection identifies Microsoft Word spawning PowerShell. Typically -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -Note that **winword_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **winword_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ False positives should be limited, but if any are present, filter as needed. | 70.0 | 70 | 100 | $parent_process_name$ on $dest$ by $user$ launched the following powershell process: $process_name$ which is very common in spearphishing attacks | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://redcanary.com/threat-detection-report/techniques/powershell/](https://redcanary.com/threat-detection-report/techniques/powershell/) diff --git a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md index 52fd311c5b..c77b993680 100644 --- a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md +++ b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md @@ -94,7 +94,7 @@ The following detection identifies Microsoft Winword.exe spawning Windows Script -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **winword_spawning_windows_script_host_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **winword_spawning_windows_script_host_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ There will be limited false positives and it will be different for every environ | 70.0 | 70 | 100 | User $user$ on $dest$ spawned Windows Script Host from Winword.exe | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1566/001/](https://attack.mitre.org/techniques/T1566/001/) diff --git a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md index f303630378..301ab592f9 100644 --- a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md +++ b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md @@ -94,7 +94,7 @@ This search looks for AWS CloudTrail events and analyse the amount of eventNames -#### Search +#### Search ``` `cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get* @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_excessive_security_scanning_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_excessive_security_scanning_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +141,9 @@ While this search has no known false positives. | 18.0 | 30 | 60 | user $user$ has excessive number of api calls $dc_events$ from these IP addresses $src$, violating the threshold of 50, using the following commands $command$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/aquasecurity/cloudsploit](https://github.com/aquasecurity/cloudsploit) diff --git a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md index 46976b9a16..2b037a4659 100644 --- a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md +++ b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md @@ -96,7 +96,7 @@ The analytics returned fields allow analysts to investigate the event further by -#### Search +#### Search ``` `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC000006A action=failure @@ -113,7 +113,8 @@ The analytics returned fields allow analysts to investigate the event further by The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **multiple_users_failing_to_authenticate_from_host_using_ntlm_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **multiple_users_failing_to_authenticate_from_host_using_ntlm_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ A host failing to authenticate with multiple valid domain users is not a common | 49.0 | 70 | 70 | Potential NTLM based password spraying attack from $Source_Workstation$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/) diff --git a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md index 24bc3a3b15..91268fbb11 100644 --- a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md +++ b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md @@ -96,7 +96,7 @@ The analytics returned fields allow analysts to investigate the event further by -#### Search +#### Search ``` `wineventlog_security` EventCode=4625 Logon_Type=2 Caller_Process_Name!="-" @@ -115,7 +115,8 @@ The analytics returned fields allow analysts to investigate the event further by The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **multiple_users_failing_to_authenticate_from_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **multiple_users_failing_to_authenticate_from_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ A process failing to authenticate with multiple users is not a common behavior f | 49.0 | 70 | 70 | Potential password spraying attack from $ComputerName$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/) diff --git a/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md b/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md index ce669d8449..7be2868379 100644 --- a/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md +++ b/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md @@ -96,7 +96,7 @@ The analytics returned fields allow analysts to investigate the event further by -#### Search +#### Search ``` `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Address!="-" @@ -114,7 +114,8 @@ The analytics returned fields allow analysts to investigate the event further by The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **multiple_users_remotely_failing_to_authenticate_from_host_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **multiple_users_remotely_failing_to_authenticate_from_host_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ A host failing to authenticate with multiple valid users against a remote host i | 49.0 | 70 | 70 | Potential password spraying attack on $ComputerName$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/) diff --git a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md index 6c1b58014b..1bc12377f9 100644 --- a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md +++ b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md @@ -94,7 +94,7 @@ this detection was designed to identifies suspicious spawned process of known MS -#### Search +#### Search ``` @@ -107,11 +107,12 @@ this detection was designed to identifies suspicious spawned process of known MS #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -Note that **office_application_spawn_rundll32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **office_application_spawn_rundll32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -148,6 +149,9 @@ unknown | 63.0 | 70 | 90 | Office application spawning rundll32.exe on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://any.run/malware-trends/trickbot](https://any.run/malware-trends/trickbot) diff --git a/docs/_posts/2021-04-13-windows_users_authenticate_using_explicit_credentials.md b/docs/_posts/2021-04-13-windows_users_authenticate_using_explicit_credentials.md index 9f274afe25..410bc95cbb 100644 --- a/docs/_posts/2021-04-13-windows_users_authenticate_using_explicit_credentials.md +++ b/docs/_posts/2021-04-13-windows_users_authenticate_using_explicit_credentials.md @@ -96,7 +96,7 @@ The analytics returned fields allow analysts to investigate the event further by -#### Search +#### Search ``` `wineventlog_security` EventCode=4648 @@ -116,7 +116,8 @@ The analytics returned fields allow analysts to investigate the event further by The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **windows_users_authenticate_using_explicit_credentials_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_users_authenticate_using_explicit_credentials_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ A source user failing attempting to authenticate multiple users on a host is not | 49.0 | 70 | 70 | Potential password spraying attack from $ComputerName$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/) diff --git a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md index 9c45821dff..0c422c3296 100644 --- a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md +++ b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md @@ -94,7 +94,7 @@ this search detects a potential malicious office document that create schedule t -#### Search +#### Search ``` `sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") ImageLoaded = "*\\taskschd.dll" @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **office_document_creating_schedule_task_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **office_document_creating_schedule_task_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * ImageLoaded @@ -142,6 +143,9 @@ unknown | 49.0 | 70 | 70 | Office document creating a schedule task on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/](https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/) diff --git a/docs/_posts/2021-04-14-office_document_executing_macro_code.md b/docs/_posts/2021-04-14-office_document_executing_macro_code.md index 8bb6a2553d..a6683efdc2 100644 --- a/docs/_posts/2021-04-14-office_document_executing_macro_code.md +++ b/docs/_posts/2021-04-14-office_document_executing_macro_code.md @@ -94,7 +94,7 @@ this detection was designed to identifies suspicious office documents that using -#### Search +#### Search ``` `sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **office_document_executing_macro_code_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **office_document_executing_macro_code_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * ImageLoaded @@ -144,6 +145,9 @@ Normal Office Document macro use for automation | 35.0 | 70 | 50 | Office document executing a macro on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.joesandbox.com/analysis/386500/0/html](https://www.joesandbox.com/analysis/386500/0/html) diff --git a/docs/_posts/2021-04-14-windows_disabled_users_failing_to_authenticate_kerberos.md b/docs/_posts/2021-04-14-windows_disabled_users_failing_to_authenticate_kerberos.md index 2c7a532c78..1ca49d99f4 100644 --- a/docs/_posts/2021-04-14-windows_disabled_users_failing_to_authenticate_kerberos.md +++ b/docs/_posts/2021-04-14-windows_disabled_users_failing_to_authenticate_kerberos.md @@ -96,7 +96,7 @@ The analytics returned fields allow analysts to investigate the event further by -#### Search +#### Search ``` `wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12 @@ -113,7 +113,8 @@ The analytics returned fields allow analysts to investigate the event further by The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **windows_disabled_users_failing_to_authenticate_kerberos_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_disabled_users_failing_to_authenticate_kerberos_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ A host failing to authenticate with multiple disabled domain users is not a comm | 49.0 | 70 | 70 | Potential Kerberos based password spraying attack from $Client_Address$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/) diff --git a/docs/_posts/2021-04-14-windows_invalid_users_failed_authentication_via_kerberos.md b/docs/_posts/2021-04-14-windows_invalid_users_failed_authentication_via_kerberos.md index 7a5d4a4773..3ebbb93f72 100644 --- a/docs/_posts/2021-04-14-windows_invalid_users_failed_authentication_via_kerberos.md +++ b/docs/_posts/2021-04-14-windows_invalid_users_failed_authentication_via_kerberos.md @@ -96,7 +96,7 @@ The analytics returned fields allow analysts to investigate the event further by -#### Search +#### Search ``` `wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$" @@ -113,7 +113,8 @@ The analytics returned fields allow analysts to investigate the event further by The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **windows_invalid_users_failed_authentication_via_kerberos_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_invalid_users_failed_authentication_via_kerberos_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ A host failing to authenticate with multiple invalid domain users is not a commo | 49.0 | 70 | 70 | Potential Kerberos based password spraying attack from $Client_Address$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/) diff --git a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md index 1c57c566c4..01c1c0304c 100644 --- a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md +++ b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md @@ -89,7 +89,7 @@ this search is to detect potential DNS exfiltration using nslookup application. -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **dns_exfiltration_using_nslookup_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **dns_exfiltration_using_nslookup_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ admin nslookup usage | 72.0 | 90 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing activity related to DNS exfiltration. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html](https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html) diff --git a/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md b/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md index b87ff4e494..7d74c0a930 100644 --- a/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md +++ b/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md @@ -96,7 +96,7 @@ The analytics returned fields allow analysts to investigate the event further by -#### Search +#### Search ``` `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC0000064 action=failure @@ -113,7 +113,8 @@ The analytics returned fields allow analysts to investigate the event further by The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ A host failing to authenticate with multiple invalid domain users is not a commo | 49.0 | 70 | 70 | Potential NTLM based password spraying attack from $Source_Workstation$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/) diff --git a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md index 0ba0fa4117..e826ac08dd 100644 --- a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md +++ b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md @@ -90,7 +90,7 @@ this search is designed to detect suspicious powershell process that tries to in -#### Search +#### Search ``` `sysmon` EventCode = 8 process_name IN ("powershell_ise.exe", "powershell.exe") TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe") @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **powershell_remote_thread_to_known_windows_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **powershell_remote_thread_to_known_windows_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +141,9 @@ unknown | 63.0 | 70 | 90 | A suspicious powershell process $process_name$ that tries to create a remote thread on target process $TargetImage$ with eventcode $EventCode$ in host $Computer$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/](https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/) diff --git a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md index 6562dd05d1..ad554eb7d0 100644 --- a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md +++ b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md @@ -91,7 +91,7 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task -#### Search +#### Search ``` `wineventlog_security` EventCode=4698 @@ -105,10 +105,11 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **schedule_task_with_http_command_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **schedule_task_with_http_command_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ unknown | 63.0 | 70 | 90 | A schedule task process commandline arguments $Arguments$ with http string on it in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/](https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/) diff --git a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md index e2752b6b07..fb14fc0e43 100644 --- a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md +++ b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md @@ -91,7 +91,7 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task -#### Search +#### Search ``` `wineventlog_security` EventCode=4698 @@ -105,10 +105,11 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **schedule_task_with_rundll32_command_trigger_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **schedule_task_with_rundll32_command_trigger_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ unknown | 70.0 | 70 | 100 | A schedule task process commandline rundll32 arguments $Arguments$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://labs.vipre.com/trickbot-and-its-modules/](https://labs.vipre.com/trickbot-and-its-modules/) diff --git a/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md b/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md index 45b2a0375a..a109255d74 100644 --- a/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md +++ b/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md @@ -94,7 +94,7 @@ this search is designed to detect suspicious wermgr.exe process that tries to co -#### Search +#### Search ``` `sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net") @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **wermgr_process_connecting_to_ip_check_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **wermgr_process_connecting_to_ip_check_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ unknown | 56.0 | 70 | 80 | Wermgr.exe process connecting IP location web services on $ComputerName$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://labs.vipre.com/trickbot-and-its-modules/](https://labs.vipre.com/trickbot-and-its-modules/) diff --git a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md index b4c60eb29a..cc8ff1d2b6 100644 --- a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md +++ b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md @@ -89,7 +89,7 @@ this search is designed to detect potential malicious wermgr.exe process that dr -#### Search +#### Search ``` `sysmon` EventCode=11 process_name = "wermgr.exe" TargetFilename = "*.exe" @@ -104,7 +104,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **wermgr_process_create_executable_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **wermgr_process_create_executable_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,6 +136,9 @@ unknown | 56.0 | 70 | 80 | Wermgr.exe writing executable files on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://labs.vipre.com/trickbot-and-its-modules/](https://labs.vipre.com/trickbot-and-its-modules/) diff --git a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md index a973cc20bc..b8cb036ecf 100644 --- a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md +++ b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md @@ -89,7 +89,7 @@ This search is designed to detect suspicious cmd and powershell process spawned -#### Search +#### Search ``` @@ -102,12 +102,13 @@ This search is designed to detect suspicious cmd and powershell process spawned #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -Note that **wermgr_process_spawned_cmd_or_powershell_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **wermgr_process_spawned_cmd_or_powershell_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ unknown | 56.0 | 70 | 80 | Wermgr.exe spawning suspicious processes on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://labs.vipre.com/trickbot-and-its-modules/](https://labs.vipre.com/trickbot-and-its-modules/) diff --git a/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md b/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md index 48e015990f..60856b06d5 100644 --- a/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md +++ b/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md @@ -89,7 +89,7 @@ This search is to detect potential DNS exfiltration using nslookup application. -#### Search +#### Search ``` `sysmon` EventCode = 1 process_name = "nslookup.exe" @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **excessive_usage_of_nslookup_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **excessive_usage_of_nslookup_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +141,9 @@ unknown | 28.0 | 40 | 70 | Excessive usage of nslookup.exe has been detected on $Computer$. This detection is triggered as as it violates the dynamic threshold | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html](https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html) diff --git a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md index 1d9cdde512..dd6c352ef6 100644 --- a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md +++ b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md @@ -1,6 +1,6 @@ --- title: "Multiple Archive Files Http Post Traffic" -excerpt: "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol +excerpt: "Exfiltration Over Unencrypted Non-C2 Protocol , Exfiltration Over Alternative Protocol " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-04-21 toc: true toc_label: "" tags: - - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol + - Exfiltration Over Unencrypted Non-C2 Protocol - Exfiltration Over Alternative Protocol - Exfiltration - Exfiltration @@ -45,7 +45,7 @@ This search is designed to detect high frequency of archive files data exfiltrat | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration | +| [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted Non-C2 Protocol | Exfiltration | | [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration | @@ -94,7 +94,7 @@ This search is designed to detect high frequency of archive files data exfiltrat -#### Search +#### Search ``` `stream_http` http_method=POST @@ -109,10 +109,11 @@ This search is designed to detect high frequency of archive files data exfiltrat #### Macros The SPL above uses the following Macros: -* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) -Note that **multiple_archive_files_http_post_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **multiple_archive_files_http_post_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ Normal archive transfer via HTTP protocol may trip this detection. | 25.0 | 50 | 50 | A http post $http_method$ sending packet with possible archive bytes header 4form_data$ in uri path $uri_path$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1560/001/](https://attack.mitre.org/techniques/T1560/001/) diff --git a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md index 83660b3d58..2562e52b6f 100644 --- a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md +++ b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md @@ -94,7 +94,7 @@ The following detection identifies a 7z.exe spawned from `Rundll32.exe` or `Dllh -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **anomalous_usage_of_7zip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **anomalous_usage_of_7zip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ False positives should be limited as this behavior is not normal for `rundll32.e | 64.0 | 80 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1560/001/](https://attack.mitre.org/techniques/T1560/001/) diff --git a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md index 8ca59d3dd2..c42e3725da 100644 --- a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md +++ b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md @@ -94,7 +94,7 @@ The following detection identifies the latest behavior utilized by IcedID malwar -#### Search +#### Search ``` @@ -107,11 +107,12 @@ The following detection identifies the latest behavior utilized by IcedID malwar #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -Note that **office_product_spawning_rundll32_with_no_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **office_product_spawning_rundll32_with_no_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ False positives should be limited, but if any are present, filter as needed. | 63.0 | 70 | 90 | office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ and no dll commandline $process$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.joesandbox.com/analysis/395471/0/html](https://www.joesandbox.com/analysis/395471/0/html) diff --git a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md index 4bf5f81e8f..63247121eb 100644 --- a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md +++ b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md @@ -1,6 +1,6 @@ --- title: "Plain HTTP POST Exfiltrated Data" -excerpt: "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol +excerpt: "Exfiltration Over Unencrypted Non-C2 Protocol , Exfiltration Over Alternative Protocol " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-04-22 toc: true toc_label: "" tags: - - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol + - Exfiltration Over Unencrypted Non-C2 Protocol - Exfiltration Over Alternative Protocol - Exfiltration - Exfiltration @@ -45,7 +45,7 @@ This search is to detect potential plain HTTP POST method data exfiltration. Thi | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration | +| [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted Non-C2 Protocol | Exfiltration | | [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration | @@ -94,7 +94,7 @@ This search is to detect potential plain HTTP POST method data exfiltration. Thi -#### Search +#### Search ``` `stream_http` http_method=POST form_data IN ("*wermgr.exe*","*svchost.exe*", "*name=\"proclist\"*","*ipconfig*", "*name=\"sysinfo\"*", "*net view*") @@ -106,10 +106,11 @@ This search is to detect potential plain HTTP POST method data exfiltration. Thi #### Macros The SPL above uses the following Macros: -* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) -Note that **plain_http_post_exfiltrated_data_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **plain_http_post_exfiltrated_data_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ unknown | 63.0 | 70 | 90 | A http post $http_method$ sending packet with plain text of information $form_data$ in uri path $uri_path$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://blog.talosintelligence.com/2020/03/trickbot-primer.html](https://blog.talosintelligence.com/2020/03/trickbot-primer.html) diff --git a/docs/_posts/2021-04-22-winword_spawning_cmd.md b/docs/_posts/2021-04-22-winword_spawning_cmd.md index c86efd4f5a..6b4bf9ddbc 100644 --- a/docs/_posts/2021-04-22-winword_spawning_cmd.md +++ b/docs/_posts/2021-04-22-winword_spawning_cmd.md @@ -94,7 +94,7 @@ The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, -#### Search +#### Search ``` @@ -107,11 +107,12 @@ The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -Note that **winword_spawning_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **winword_spawning_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ False positives should be limited, but if any are present, filter as needed. | 70.0 | 70 | 100 | $parent_process_name$ on $dest$ by $user$ launched command: $process_name$ which is very common in spearphishing attacks. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://app.any.run/tasks/73af0064-a785-4c0a-ab0d-cde593fe16ef/](https://app.any.run/tasks/73af0064-a785-4c0a-ab0d-cde593fe16ef/) diff --git a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md index 5ac021c30b..699d39c2af 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md +++ b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md @@ -94,7 +94,7 @@ The following detection identifies the latest behavior utilized by different mal -#### Search +#### Search ``` @@ -107,11 +107,12 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: -* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) -Note that **office_product_spawning_bitsadmin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **office_product_spawning_bitsadmin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ No false positives known. Filter as needed. | 63.0 | 70 | 90 | office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md) diff --git a/docs/_posts/2021-04-26-office_product_spawning_certutil.md b/docs/_posts/2021-04-26-office_product_spawning_certutil.md index bd7147ecee..6755b72727 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_certutil.md +++ b/docs/_posts/2021-04-26-office_product_spawning_certutil.md @@ -94,7 +94,7 @@ The following detection identifies the latest behavior utilized by different mal -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **office_product_spawning_certutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **office_product_spawning_certutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ No false positives known. Filter as needed. | 63.0 | 70 | 90 | office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://redcanary.com/threat-detection-report/threats/TA551/](https://redcanary.com/threat-detection-report/threats/TA551/) diff --git a/docs/_posts/2021-04-26-office_product_spawning_mshta.md b/docs/_posts/2021-04-26-office_product_spawning_mshta.md index 686d4f6f42..e7f74b2c79 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_mshta.md +++ b/docs/_posts/2021-04-26-office_product_spawning_mshta.md @@ -94,7 +94,7 @@ The following detection identifies the latest behavior utilized by different mal -#### Search +#### Search ``` @@ -107,11 +107,12 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: -* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) -Note that **office_product_spawning_mshta_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **office_product_spawning_mshta_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,6 +149,9 @@ No false positives known. Filter as needed. | 63.0 | 70 | 90 | office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://redcanary.com/threat-detection-report/threats/TA551/](https://redcanary.com/threat-detection-report/threats/TA551/) diff --git a/docs/_posts/2021-04-26-trickbot_named_pipe.md b/docs/_posts/2021-04-26-trickbot_named_pipe.md index 0967d4b86f..a0bf8d31b5 100644 --- a/docs/_posts/2021-04-26-trickbot_named_pipe.md +++ b/docs/_posts/2021-04-26-trickbot_named_pipe.md @@ -90,7 +90,7 @@ this search is to detect potential trickbot infection through the create/connect -#### Search +#### Search ``` `sysmon` EventCode IN (17,18) PipeName="\\pipe\\*lacesomepipe" @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **trickbot_named_pipe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **trickbot_named_pipe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ unknown | 42.0 | 70 | 60 | Possible Trickbot namedpipe created on $Computer$ by $Image$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://labs.vipre.com/trickbot-and-its-modules/](https://labs.vipre.com/trickbot-and-its-modules/) diff --git a/docs/_posts/2021-04-29-icacls_deny_command.md b/docs/_posts/2021-04-29-icacls_deny_command.md index ab528586f7..c730487f67 100644 --- a/docs/_posts/2021-04-29-icacls_deny_command.md +++ b/docs/_posts/2021-04-29-icacls_deny_command.md @@ -89,7 +89,7 @@ This analytic identifies a potential adversary that changes the security permiss -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **icacls_deny_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **icacls_deny_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,6 +137,9 @@ Unknown. It is possible some administrative scripts use ICacls. Filter as needed | 72.0 | 90 | 80 | Process name $process_name$ with deny argument executed by $user$ to change security permission of a specific file or directory on host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md index 3a7a4d7714..3088a7f722 100644 --- a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md +++ b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md @@ -96,7 +96,7 @@ This analytic will detect suspicious driver loaded paths. This technique is comm -#### Search +#### Search ``` `sysmon` EventCode=6 ImageLoaded = "*.sys" NOT (ImageLoaded IN("*\\WINDOWS\\inf","*\\WINDOWS\\System32\\drivers\\*", "*\\WINDOWS\\System32\\DriverStore\\FileRepository\\*")) @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **suspicious_driver_loaded_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_driver_loaded_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ Limited false positives will be present. Some applications do load drivers | 63.0 | 70 | 90 | Suspicious driver $ImageLoaded$ on $Computer$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/](https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/) diff --git a/docs/_posts/2021-04-29-xmrig_driver_loaded.md b/docs/_posts/2021-04-29-xmrig_driver_loaded.md index c435c841c1..8740d183c4 100644 --- a/docs/_posts/2021-04-29-xmrig_driver_loaded.md +++ b/docs/_posts/2021-04-29-xmrig_driver_loaded.md @@ -96,7 +96,7 @@ This analytic identifies XMRIG coinminer driver installation on the system. The -#### Search +#### Search ``` `sysmon` EventCode=6 Signature="Noriyuki MIYAZAKI" OR ImageLoaded= "*\\WinRing0x64.sys" @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **xmrig_driver_loaded_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **xmrig_driver_loaded_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ False positives should be limited. | 80.0 | 80 | 100 | A driver $ImageLoaded$ related to xmrig crytominer loaded in host $Computer$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/](https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/) diff --git a/docs/_posts/2021-05-04-deleting_of_net_users.md b/docs/_posts/2021-05-04-deleting_of_net_users.md index 560df410e3..0cd8ac9cac 100644 --- a/docs/_posts/2021-05-04-deleting_of_net_users.md +++ b/docs/_posts/2021-05-04-deleting_of_net_users.md @@ -89,7 +89,7 @@ This analytic will detect a suspicious net.exe/net1.exe command-line to delete a -#### Search +#### Search ``` @@ -103,10 +103,11 @@ This analytic will detect a suspicious net.exe/net1.exe command-line to delete a #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -Note that **deleting_of_net_users_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **deleting_of_net_users_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ System administrators or scripts may delete user accounts via this technique. Fi | 25.0 | 50 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete accounts. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-04-disabling_net_user_account.md b/docs/_posts/2021-05-04-disabling_net_user_account.md index c3261d8494..2869992e52 100644 --- a/docs/_posts/2021-05-04-disabling_net_user_account.md +++ b/docs/_posts/2021-05-04-disabling_net_user_account.md @@ -89,7 +89,7 @@ This analytic will identify a suspicious command-line that disables a user accou -#### Search +#### Search ``` @@ -103,10 +103,11 @@ This analytic will identify a suspicious command-line that disables a user accou #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -Note that **disabling_net_user_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disabling_net_user_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ unknown | 42.0 | 70 | 60 | An instance of $parent_process_name$ spawning $process_name$ was identified disabling a user account on endpoint $dest$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md index bcc5f8103d..eab11f7911 100644 --- a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md +++ b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md @@ -89,7 +89,7 @@ This analytic will identify suspicious series of command-line to disable several -#### Search +#### Search ``` @@ -106,7 +106,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **excessive_attempt_to_disable_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **excessive_attempt_to_disable_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ unknown | 80.0 | 80 | 100 | An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md index eb8cceda4d..f4014dad41 100644 --- a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md +++ b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md @@ -89,7 +89,7 @@ This analytic identifies suspicious series of attempt to kill multiple services -#### Search +#### Search ``` @@ -104,10 +104,11 @@ This analytic identifies suspicious series of attempt to kill multiple services #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -Note that **excessive_service_stop_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **excessive_service_stop_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ unknown | 80.0 | 80 | 100 | An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md index 46307270d4..b821c331a6 100644 --- a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md +++ b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md @@ -94,7 +94,7 @@ This analytic identifies excessive usage of `taskkill.exe` application. This app -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **excessive_usage_of_taskkill_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **excessive_usage_of_taskkill_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ Unknown. Filter as needed. | 28.0 | 40 | 70 | Excessive usage of taskkill.exe with process id $process_id$ (more than 10 within 1m) has been detected on $dest$ with a parent process of $parent_process_name$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-04-icacls_grant_command.md b/docs/_posts/2021-05-04-icacls_grant_command.md index 96e51609b8..47be477d95 100644 --- a/docs/_posts/2021-05-04-icacls_grant_command.md +++ b/docs/_posts/2021-05-04-icacls_grant_command.md @@ -89,7 +89,7 @@ This analytic identifies potential adversaries that modify the security permissi -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **icacls_grant_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **icacls_grant_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ Unknown. Filter as needed. | 49.0 | 70 | 70 | Process name $process_name$ with grant argument executed by $user$ to change security permission of a specific file or directory on host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md index 0b1aef1555..a64dd21bac 100644 --- a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md +++ b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md @@ -94,7 +94,7 @@ The following analytic identifies the use of `wmic.exe` using `delete` to remove -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **process_kill_base_on_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **process_kill_base_on_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ Unknown. | 56.0 | 70 | 80 | A process $process_name$ attempt to kill process by its file path using commandline $process$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-05-suspicious_process_file_path.md b/docs/_posts/2021-05-05-suspicious_process_file_path.md index 716e8a9a04..d8c0ac37c5 100644 --- a/docs/_posts/2021-05-05-suspicious_process_file_path.md +++ b/docs/_posts/2021-05-05-suspicious_process_file_path.md @@ -90,7 +90,7 @@ The following analytic will detect a suspicious process running in a file path w -#### Search +#### Search ``` @@ -106,7 +106,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **suspicious_process_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_process_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ Administrators may allow execution of specific binaries in non-standard paths. F | 35.0 | 70 | 50 | Suspicioues process $Processes.process_path.file_path$ running from suspicious location | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/](https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/) diff --git a/docs/_posts/2021-05-06-download_files_using_telegram.md b/docs/_posts/2021-05-06-download_files_using_telegram.md index 3df89c9dc2..682927bf6c 100644 --- a/docs/_posts/2021-05-06-download_files_using_telegram.md +++ b/docs/_posts/2021-05-06-download_files_using_telegram.md @@ -89,7 +89,7 @@ The following analytic will identify a suspicious download by the Telegram appli -#### Search +#### Search ``` `sysmon` EventCode= 15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier" @@ -104,7 +104,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **download_files_using_telegram_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **download_files_using_telegram_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,6 +136,9 @@ normal download of file in telegram app. (if it was a common app in network) | 49.0 | 70 | 70 | Suspicious files were downloaded with the Telegram application on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md index 5e3dabdc4a..b358ad0c56 100644 --- a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md +++ b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md @@ -89,7 +89,7 @@ This analytic will detect a suspicious Telegram process enumerating all network -#### Search +#### Search ``` `wineventlog_security` EventCode=4798 Process_Name = "*\\telegram.exe" @@ -101,10 +101,11 @@ This analytic will detect a suspicious Telegram process enumerating all network #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **enumerate_users_local_group_using_telegram_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **enumerate_users_local_group_using_telegram_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ unknown | 80.0 | 80 | 100 | The Telegram application has been identified enumerating local groups on $ComputerName$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md index f17c48e9cf..b88806c5cf 100644 --- a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md +++ b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md @@ -89,7 +89,7 @@ This analytic identifies excessive usage of `net.exe` or `net1.exe` within a buc -#### Search +#### Search ``` @@ -104,10 +104,11 @@ This analytic identifies excessive usage of `net.exe` or `net1.exe` within a buc #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -Note that **excessive_usage_of_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **excessive_usage_of_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ unknown. Filter as needed. Modify the time span as needed. | 28.0 | 40 | 70 | Excessive usage of net1.exe or net.exe within 1m, with command line $process$ has been detected on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md index e6b026c58e..0976f518ee 100644 --- a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md +++ b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md @@ -89,7 +89,7 @@ This analytic will identify suspicious executable or scripts (known file extensi -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **executables_or_script_creation_in_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **executables_or_script_creation_in_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ Administrators may allow creation of script or exe in the paths specified. Filte | 56.0 | 80 | 70 | Suspicious executable or scripts with file name $file_name$, $file_path$ and process_id $process_id$ executed in suspicious file path in Windows by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md index 171c753ff8..ef65642160 100644 --- a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md +++ b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md @@ -89,7 +89,7 @@ The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe` o -#### Search +#### Search ``` @@ -106,7 +106,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **excessive_usage_of_cacls_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **excessive_usage_of_cacls_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ Administrators or administrative scripts may use this application. Filter as nee | 80.0 | 80 | 100 | An excessive amount of $process_name$ was executed on $dest$ attempting to modify permissions. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md index 952bd4bbbb..0b96c2a762 100644 --- a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md +++ b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md @@ -91,7 +91,7 @@ This analytic identifies an on demand run of a Windows Schedule Task through she -#### Search +#### Search ``` @@ -107,7 +107,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **schtasks_run_task_on_demand_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **schtasks_run_task_on_demand_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ Administrators may use to debug Schedule Task entries. Filter as needed. | 48.0 | 60 | 80 | A "on demand" execution of schedule task process $process_name$ using commandline $process$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md b/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md index 412369d6c9..b93e66fd34 100644 --- a/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md +++ b/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md @@ -89,7 +89,7 @@ This following analytic detects PowerShell command to delete shadow copy using t -#### Search +#### Search ``` `powershell` EventCode=4104 Message= "*ShadowCopy*" (Message = "*Delete*" OR Message = "*Remove*") @@ -104,7 +104,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **delete_shadowcopy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **delete_shadowcopy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,6 +136,9 @@ unknown | 81.0 | 90 | 90 | An attempt to delete ShadowCopy was performed using PowerShell on $ComputerName$ by $User$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html](https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html) diff --git a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md index 521fbb01c4..33a2cc048e 100644 --- a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md +++ b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md @@ -1,6 +1,6 @@ --- title: "CMLUA Or CMSTPLUA UAC Bypass" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , CMSTP " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-05-13 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - CMSTP - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ This analytic detects a potential process using COM Object like CMLUA or CMSTPLU | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.003](https://attack.mitre.org/techniques/T1218/003/) | CMSTP | Defense Evasion | @@ -94,7 +94,7 @@ This analytic detects a potential process using COM Object like CMLUA or CMSTPLU -#### Search +#### Search ``` `sysmon` EventCode=7 ImageLoaded IN ("*\\CMLUA.dll", "*\\CMSTPLUA.dll", "*\\CMLUAUTIL.dll") NOT(process_name IN("CMSTP.exe", "CMMGR32.exe")) NOT(Image IN("*\\windows\\*", "*\\program files*")) @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **cmlua_or_cmstplua_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **cmlua_or_cmstplua_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ Legitimate windows application that are not on the list loading this dll. Filter | 80.0 | 80 | 100 | The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $Computer$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1218/003/](https://attack.mitre.org/techniques/T1218/003/) diff --git a/docs/_posts/2021-05-13-slui_runas_elevated.md b/docs/_posts/2021-05-13-slui_runas_elevated.md index dc3b4bd660..f38abdf792 100644 --- a/docs/_posts/2021-05-13-slui_runas_elevated.md +++ b/docs/_posts/2021-05-13-slui_runas_elevated.md @@ -96,7 +96,7 @@ The following analytic identifies the Microsoft Software Licensing User Interfac -#### Search +#### Search ``` @@ -112,7 +112,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **slui_runas_elevated_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **slui_runas_elevated_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ Limited false positives should be present as this is not commonly used by legiti | 63.0 | 70 | 90 | A slui process $process_name$ with elevated commandline $process$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.exploit-db.com/exploits/46998](https://www.exploit-db.com/exploits/46998) diff --git a/docs/_posts/2021-05-13-slui_spawning_a_process.md b/docs/_posts/2021-05-13-slui_spawning_a_process.md index 296a5584db..06cc4721f7 100644 --- a/docs/_posts/2021-05-13-slui_spawning_a_process.md +++ b/docs/_posts/2021-05-13-slui_spawning_a_process.md @@ -96,7 +96,7 @@ The following analytic identifies the Microsoft Software Licensing User Interfac -#### Search +#### Search ``` @@ -112,7 +112,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **slui_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **slui_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ Certain applications may spawn from `slui.exe` that are legitimate. Filtering wi | 63.0 | 70 | 90 | A slui process $parent_process_name$ spawning child process $process_name$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.exploit-db.com/exploits/46998](https://www.exploit-db.com/exploits/46998) diff --git a/docs/_posts/2021-05-18-services_escalate_exe.md b/docs/_posts/2021-05-18-services_escalate_exe.md index 8b7758e3c7..50363a5f52 100644 --- a/docs/_posts/2021-05-18-services_escalate_exe.md +++ b/docs/_posts/2021-05-18-services_escalate_exe.md @@ -90,7 +90,7 @@ The following analytic identifies the use of `svc-exe` with Cobalt Strike. The b -#### Search +#### Search ``` @@ -106,7 +106,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **services_escalate_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **services_escalate_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ False positives should be limited as `services.exe` should never spawn a process | 76.0 | 80 | 95 | A service process $parent_process_name$ with process path $process_path$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/](https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/) diff --git a/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md b/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md index f938a7216f..b0d8da0519 100644 --- a/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md +++ b/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md @@ -94,7 +94,7 @@ The following analytic identifies suspicious PowerShell command to allow inbound -#### Search +#### Search ``` `powershell` EventCode=4104 Message = "*firewall*" Message = "*Inbound*" Message = "*Allow*" Message = "*-LocalPort*" @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **allow_inbound_traffic_in_firewall_rule_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **allow_inbound_traffic_in_firewall_rule_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ administrator may allow inbound traffic in certain network or machine. | 3.0 | 10 | 30 | Suspicious firewall modification detected on endpoint $ComputerName$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps](https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps) diff --git a/docs/_posts/2021-05-19-mailsniper_invoke_functions.md b/docs/_posts/2021-05-19-mailsniper_invoke_functions.md index a4b8c67d8d..43d6819934 100644 --- a/docs/_posts/2021-05-19-mailsniper_invoke_functions.md +++ b/docs/_posts/2021-05-19-mailsniper_invoke_functions.md @@ -94,7 +94,7 @@ This search is to detect known mailsniper.ps1 functions executed in a machine. T -#### Search +#### Search ``` `powershell` EventCode=4104 Message IN ("*Invoke-GlobalO365MailSearch*", "*Invoke-GlobalMailSearch*", "*Invoke-SelfSearch*", "*Invoke-PasswordSprayOWA*", "*Invoke-PasswordSprayEWS*","*Invoke-DomainHarvestOWA*", "*Invoke-UsernameHarvestOWA*","*Invoke-OpenInboxFinder*","*Invoke-InjectGEventAPI*","*Invoke-InjectGEvent*","*Invoke-SearchGmail*", "*Invoke-MonitorCredSniper*", "*Invoke-AddGmailRule*","*Invoke-PasswordSprayEAS*","*Invoke-UsernameHarvestEAS*") @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **mailsniper_invoke_functions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **mailsniper_invoke_functions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ unknown | 72.0 | 90 | 80 | mailsniper.ps1 functions $Message$ executed on a $ComputerName$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.blackhillsinfosec.com/introducing-mailsniper-a-tool-for-searching-every-users-email-for-sensitive-data/](https://www.blackhillsinfosec.com/introducing-mailsniper-a-tool-for-searching-every-users-email-for-sensitive-data/) diff --git a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md index bdda66183f..c8cfde7233 100644 --- a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md +++ b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md @@ -106,7 +106,7 @@ This analytic identifies a common behavior by Cobalt Strike and other frameworks -#### Search +#### Search ``` @@ -119,11 +119,12 @@ This analytic identifies a common behavior by Cobalt Strike and other frameworks #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -Note that **cmd_echo_pipe_-_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **cmd_echo_pipe_-_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -159,6 +160,9 @@ Unknown. It is possible filtering may be required to ensure fidelity. | 64.0 | 80 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ potentially performing privilege escalation using named pipes related to Cobalt Strike and other frameworks. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://redcanary.com/threat-detection-report/threats/cobalt-strike/](https://redcanary.com/threat-detection-report/threats/cobalt-strike/) diff --git a/docs/_posts/2021-05-21-winrm_spawning_a_process.md b/docs/_posts/2021-05-21-winrm_spawning_a_process.md index ac0c0afcab..a4280d98c0 100644 --- a/docs/_posts/2021-05-21-winrm_spawning_a_process.md +++ b/docs/_posts/2021-05-21-winrm_spawning_a_process.md @@ -17,7 +17,7 @@ tags: - Endpoint --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -97,7 +97,7 @@ The following analytic identifies suspicious processes spawning from WinRM (wsmp -#### Search +#### Search ``` @@ -113,7 +113,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **winrm_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **winrm_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ Unknown. Add new processes or filter as needed. It is possible system management | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/win_susp_shell_spawn_from_winrm.yml](https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/win_susp_shell_spawn_from_winrm.yml) diff --git a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md index 51e22654c4..a55645df3e 100644 --- a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md +++ b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md @@ -94,7 +94,7 @@ This analytic detects a potential usage of secretsdump.py tool for dumping crede -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **secretdumps_offline_ntds_dumping_tool_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **secretdumps_offline_ntds_dumping_tool_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ unknown | 80.0 | 80 | 100 | A secretdump process $process_name$ with secretdump commandline $process$ to dump credentials in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py) diff --git a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md index fcc672df45..e9dcade39a 100644 --- a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md +++ b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md @@ -119,7 +119,7 @@ SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. Shar -#### Search +#### Search ``` @@ -135,7 +135,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_sharphound_file_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_sharphound_file_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -166,6 +167,9 @@ False positives should be limited as the analytic is specific to a filename with | 24.0 | 30 | 80 | Potential SharpHound file modifications identified on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/software/S0521/](https://attack.mitre.org/software/S0521/) diff --git a/docs/_posts/2021-05-27-detect_sharphound_usage.md b/docs/_posts/2021-05-27-detect_sharphound_usage.md index 85b178f3eb..3f6e2dac8b 100644 --- a/docs/_posts/2021-05-27-detect_sharphound_usage.md +++ b/docs/_posts/2021-05-27-detect_sharphound_usage.md @@ -119,7 +119,7 @@ The following analytic identifies SharpHound binary usage by using the original -#### Search +#### Search ``` @@ -135,7 +135,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_sharphound_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_sharphound_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -172,6 +173,9 @@ False positives should be limited as this is specific to a file attribute not us | 24.0 | 30 | 80 | Potential SharpHound binary identified on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/software/S0521/](https://attack.mitre.org/software/S0521/) diff --git a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md index a02adde856..9dd15a69d0 100644 --- a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md +++ b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md @@ -119,7 +119,7 @@ The following analytic identifies the common command-line argument used by Azure -#### Search +#### Search ``` @@ -135,7 +135,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_azurehound_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_azurehound_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -171,6 +172,9 @@ Unknown. | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ using AzureHound to enumerate AzureAD. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/software/S0521/](https://attack.mitre.org/software/S0521/) diff --git a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md index 707039ada2..f31dcdbdac 100644 --- a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md +++ b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md @@ -119,7 +119,7 @@ The following analytic is similar to SharpHound file modifications, but this ins -#### Search +#### Search ``` @@ -135,7 +135,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_azurehound_file_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_azurehound_file_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -165,6 +166,9 @@ False positives should be limited as the analytic is specific to a filename with | 63.0 | 70 | 90 | A file - $file_name$ was written to disk that is related to AzureHound, a AzureAD enumeration utility, has occurred on endpoint $dest$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350](https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350) diff --git a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md index d7f83bb859..905a6d655d 100644 --- a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md +++ b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md @@ -119,7 +119,7 @@ The following analytic identifies common command-line arguments used by SharpHou -#### Search +#### Search ``` @@ -135,7 +135,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_sharphound_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_sharphound_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -168,6 +169,9 @@ False positives should be limited as the arguments used are specific to SharpHou | 24.0 | 30 | 80 | Possible SharpHound command-Line arguments identified on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/software/S0521/](https://attack.mitre.org/software/S0521/) diff --git a/docs/_posts/2021-06-02-conti_common_exec_parameter.md b/docs/_posts/2021-06-02-conti_common_exec_parameter.md index f7f3380ff6..7e145b9580 100644 --- a/docs/_posts/2021-06-02-conti_common_exec_parameter.md +++ b/docs/_posts/2021-06-02-conti_common_exec_parameter.md @@ -89,7 +89,7 @@ This search detects the suspicious commandline argument of revil ransomware to e -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **conti_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **conti_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ To successfully implement this search, you need to be ingesting logs with the pr | 64.0 | 80 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing specific Conti Ransomware related parameters. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://malpedia.caad.fkie.fraunhofer.de/details/win.conti](https://malpedia.caad.fkie.fraunhofer.de/details/win.conti) diff --git a/docs/_posts/2021-06-02-modification_of_wallpaper.md b/docs/_posts/2021-06-02-modification_of_wallpaper.md index d032ec5558..01632e648e 100644 --- a/docs/_posts/2021-06-02-modification_of_wallpaper.md +++ b/docs/_posts/2021-06-02-modification_of_wallpaper.md @@ -89,7 +89,7 @@ This analytic identifies suspicious modification of registry to deface or change -#### Search +#### Search ``` `sysmon` EventCode =13 (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" AND Image != "*\\explorer.exe") OR (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper" AND Details = "*\\temp\\*") @@ -104,7 +104,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **modification_of_wallpaper_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **modification_of_wallpaper_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +141,9 @@ To successfully implement this search, you need to be ingesting logs with the Im | 54.0 | 60 | 90 | Wallpaper modification on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/](https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/) diff --git a/docs/_posts/2021-06-02-revil_common_exec_parameter.md b/docs/_posts/2021-06-02-revil_common_exec_parameter.md index cbbbaceebe..56a282977d 100644 --- a/docs/_posts/2021-06-02-revil_common_exec_parameter.md +++ b/docs/_posts/2021-06-02-revil_common_exec_parameter.md @@ -89,7 +89,7 @@ This analytic identifies suspicious commandline parameter that are commonly used -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **revil_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **revil_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ third party tool may have same command line parameters as revil ransomware. | 54.0 | 60 | 90 | A process $process_name$ with commandline $process$ related to revil ransomware in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/](https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/) diff --git a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md index 6bcf19ea18..4f4b0b7bcd 100644 --- a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md +++ b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md @@ -1,6 +1,6 @@ --- title: "Wbemprox COM Object Execution" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , CMSTP " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-06-02 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - CMSTP - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ this search is designed to detect potential malicious process loading COM object | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.003](https://attack.mitre.org/techniques/T1218/003/) | CMSTP | Defense Evasion | @@ -94,7 +94,7 @@ this search is designed to detect potential malicious process loading COM object -#### Search +#### Search ``` `sysmon` EventCode=7 ImageLoaded IN ("*\\fastprox.dll", "*\\wbemprox.dll", "*\\wbemcomn.dll") NOT (process_name IN ("wmiprvse.exe", "WmiApSrv.exe", "unsecapp.exe")) NOT(Image IN("*\\windows\\*","*\\program files*", "*\\wbem\\*")) @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **wbemprox_com_object_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **wbemprox_com_object_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ legitimate process that are not in the exception list may trigger this event. | 35.0 | 70 | 50 | Suspicious COM Object Execution on $Computer$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/](https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/) diff --git a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md index b5623471cf..b24cf8cb2c 100644 --- a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md +++ b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md @@ -89,7 +89,7 @@ This search detects a suspicioous termination of known services killed by ransom -#### Search +#### Search ``` `wineventlog_system` EventCode=7036 Message IN ("*Volume Shadow Copy*","*VSS*", "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*") Message="*service entered the stopped state*" @@ -104,7 +104,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) -Note that **known_services_killed_by_ransomware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **known_services_killed_by_ransomware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,6 +135,9 @@ Admin activities or installing related updates may do a sudden stop to list of s | 72.0 | 90 | 80 | Known services $Message$ terminated by a potential ransomware on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/](https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/) diff --git a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md index a7e398345f..40bb9be438 100644 --- a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md +++ b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md @@ -89,7 +89,7 @@ This detection targets behaviors observed in post exploit kits like Meterpreter -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **excessive_number_of_taskhost_processes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **excessive_number_of_taskhost_processes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ Administrators, administrative actions or certain applications may run many inst | 56.0 | 80 | 70 | An excessive amount of $process_name$ was executed on $dest$ indicative of suspicious behavior. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/software/S0250/](https://attack.mitre.org/software/S0250/) diff --git a/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md b/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md index 4d7beca380..8c8f19e96e 100644 --- a/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md +++ b/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md @@ -102,7 +102,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It -#### Search +#### Search ``` `powershell` EventCode=4104 Message=*getprocaddress* @@ -117,7 +117,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **powershell_fileless_process_injection_via_getprocaddress_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **powershell_fileless_process_injection_via_getprocaddress_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,6 +149,9 @@ Limited false positives. Filter as needed. | 48.0 | 60 | 80 | A suspicious powershell script contains GetProcAddress API in $Message$ with EventCode $EventCode$ in host $ComputerName$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.) diff --git a/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md b/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md index 44f9a2f31b..fec77a66ff 100644 --- a/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md +++ b/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md @@ -101,7 +101,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It -#### Search +#### Search ``` `powershell` EventCode=4104 Message=*frombase64string* @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **powershell_fileless_script_contains_base64_encoded_content_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **powershell_fileless_script_contains_base64_encoded_content_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ False positives should be limited. Filter as needed. | 56.0 | 70 | 80 | A suspicious powershell script contains base64 command in $Message$ with EventCode $EventCode$ in host $ComputerName$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.) diff --git a/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md b/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md index ecd566ca7f..bab04b8013 100644 --- a/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md +++ b/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md @@ -95,7 +95,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It -#### Search +#### Search ``` `powershell` EventCode=4104 (Message=*system.net.webclient* AND Message=*frombase64string*) @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **detect_empire_with_powershell_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_empire_with_powershell_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ False positives may only pertain to it not being related to Empire, but another | 81.0 | 90 | 90 | The following behavior was identified and typically related to PowerShell-Empire on $ComputerName$ by $User$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.) diff --git a/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md b/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md index 683a752611..a44d983520 100644 --- a/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md +++ b/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md @@ -90,7 +90,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It -#### Search +#### Search ``` `powershell` EventCode=4104 Message IN (*mimikatz*, *-dumpcr*, *sekurlsa::pth*, *kerberos::ptt*, *kerberos::golden*) @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **detect_mimikatz_with_powershell_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_mimikatz_with_powershell_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,6 +137,9 @@ False positives should be limited as the commands being identifies are quite spe | 90.0 | 90 | 100 | The following behavior was identified and typically related to MimiKatz being loaded within the context of PowerShell on $ComputerName$ by $User$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.) diff --git a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md index fe2298c7a6..a04804d565 100644 --- a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md +++ b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md @@ -100,7 +100,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It -#### Search +#### Search ``` `powershell` EventCode=4104 ScriptBlockText = *system.management.automation.amsi* @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **unloading_amsi_via_reflection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **unloading_amsi_via_reflection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ Potential for some third party applications to disable AMSI upon invocation. Fil | 49.0 | 70 | 70 | Possible AMSI Unloading via Reflection using PowerShell on $ComputerName$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.) diff --git a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md index 91236ed084..eda019d148 100644 --- a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md +++ b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md @@ -94,7 +94,7 @@ this search is to detect execution of `cipher.exe` to clear the unallocated sect -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **clear_unallocated_sector_using_cipher_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **clear_unallocated_sector_using_cipher_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ administrator may execute this app to manage disk | 90.0 | 100 | 90 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors of a specific disk. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/](https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/) diff --git a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md index c205b080f3..8008a7681c 100644 --- a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md +++ b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md @@ -94,7 +94,7 @@ This search is to detect execution of wevtutil.exe to disable logs. This techniq -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **disable_logs_using_wevtutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disable_logs_using_wevtutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ network operator may disable audit event logs for debugging purposes. | 24.0 | 30 | 80 | WevtUtil.exe used to disable Event Logging on $dest | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/](https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/) diff --git a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md index f1c3e3a87e..418a531564 100644 --- a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md +++ b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md @@ -89,7 +89,7 @@ This search is to detect a modification of file or directory permission using ta -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **permission_modification_using_takeown_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **permission_modification_using_takeown_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ takeown.exe is a normal windows application that may used by network operator. | 56.0 | 70 | 80 | A suspicious of execution of $process_name$ with process id $process_id$ and commandline $process$ to modify permission of directory or files in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/](https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/) diff --git a/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md b/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md index 3ba3673080..339783be67 100644 --- a/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md +++ b/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md @@ -93,7 +93,7 @@ The following analytic identifies suspicious PowerShell script execution via Eve -#### Search +#### Search ``` `powershell` EventCode=4104 Message = "*Threading.Mutex*" @@ -108,7 +108,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **powershell_creating_thread_mutex_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **powershell_creating_thread_mutex_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ powershell developer may used this function in their script for instance checkin | 40.0 | 50 | 80 | A suspicious powershell script contains Thread Mutex in $Message$ with EventCode $EventCode$ in host $ComputerName$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://isc.sans.edu/forums/diary/Some+Powershell+Malicious+Code/22988/](https://isc.sans.edu/forums/diary/Some+Powershell+Malicious+Code/22988/) diff --git a/docs/_posts/2021-06-10-powershell_domain_enumeration.md b/docs/_posts/2021-06-10-powershell_domain_enumeration.md index b683f85f74..12f0f3cdd7 100644 --- a/docs/_posts/2021-06-10-powershell_domain_enumeration.md +++ b/docs/_posts/2021-06-10-powershell_domain_enumeration.md @@ -95,7 +95,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It -#### Search +#### Search ``` `powershell` EventCode=4104 Message IN (*get-netdomaintrust*, *get-netforesttrust*, *get-addomain*, *get-adgroupmember*, *get-domainuser*) @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **powershell_domain_enumeration_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **powershell_domain_enumeration_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ It is possible there will be false positives, filter as needed. | 42.0 | 60 | 70 | A suspicious powershell script contains domain enumeration command in $Message$ with EventCode $EventCode$ in host $ComputerName$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.) diff --git a/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md b/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md index 959c1244ee..6bfed2dc83 100644 --- a/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md +++ b/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md @@ -95,7 +95,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It -#### Search +#### Search ``` `powershell` EventCode=4104 Message IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*") @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **powershell_loading_dotnet_into_memory_via_reflection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **powershell_loading_dotnet_into_memory_via_reflection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ False positives should be limited as day to day scripts do not use this method. | 56.0 | 70 | 80 | A suspicious powershell script contains reflective class assembly command in $Message$ to load .net code in memory with EventCode $EventCode$ in host $ComputerName$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly?view=net-5.0](https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly?view=net-5.0) diff --git a/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md b/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md index 297396ae8c..ebd8c6f395 100644 --- a/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md +++ b/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md @@ -93,7 +93,7 @@ The following analytic identifies suspicious PowerShell script execution via Eve -#### Search +#### Search ``` `powershell` EventCode=4104 Message = "*IO.Compression.*" OR Message = "*IO.StreamReader*" OR Message = "*]::Decompress*" @@ -108,7 +108,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **powershell_processing_stream_of_data_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **powershell_processing_stream_of_data_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ powershell may used this function to process compressed data. | 40.0 | 50 | 80 | A suspicious powershell script contains stream command in $Message$ commonly for processing compressed or to decompressed binary file with EventCode $EventCode$ in host $ComputerName$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://medium.com/@ahmedjouini99/deobfuscating-emotets-powershell-payload-e39fb116f7b9](https://medium.com/@ahmedjouini99/deobfuscating-emotets-powershell-payload-e39fb116f7b9) diff --git a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md index 2dccf3243e..0651e952bb 100644 --- a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md +++ b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md @@ -89,7 +89,7 @@ This search is to detect a suspicious bcdedit.exe execution to ignore all failur -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **prevent_automatic_repair_mode_using_bcdedit_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **prevent_automatic_repair_mode_using_bcdedit_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ Administrators may modify the boot configuration ignore failure during testing a | 56.0 | 70 | 80 | A suspicious process $process_name$ with process id $process_id$ contains commandline $process$ to ignore all bcdedit execution failure in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf](https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf) diff --git a/docs/_posts/2021-06-10-recon_using_wmi_class.md b/docs/_posts/2021-06-10-recon_using_wmi_class.md index 2e3f55223d..fa334abcc4 100644 --- a/docs/_posts/2021-06-10-recon_using_wmi_class.md +++ b/docs/_posts/2021-06-10-recon_using_wmi_class.md @@ -88,7 +88,7 @@ The following analytic identifies suspicious PowerShell via EventCode 4104, wher -#### Search +#### Search ``` `powershell` EventCode=4104 (Message= "*SELECT*" OR Message= "*Get-WmiObject*") AND (Message= "*Win32_Bios*" OR Message= "*Win32_OperatingSystem*" OR Message= "*Win32_Processor*" OR Message= "*Win32_ComputerSystem*" OR Message= "*Win32_ComputerSystemProduct*" OR Message= "*Win32_ShadowCopy*") @@ -103,7 +103,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **recon_using_wmi_class_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **recon_using_wmi_class_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,6 +135,9 @@ network administrator may used this command for checking purposes | 60.0 | 75 | 80 | A suspicious powershell script contains host recon command in $Message$ with EventCode $EventCode$ in host $ComputerName$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/](https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/) diff --git a/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md b/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md index 2a72915bf1..f9e3ae5126 100644 --- a/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md +++ b/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md @@ -88,7 +88,7 @@ The following analytic identifies suspicious PowerShell script execution via Eve -#### Search +#### Search ``` `powershell` EventCode=4104 Message= "*SELECT*" AND (Message="*Win32_Process*" OR Message="*Win32_Service*") @@ -103,7 +103,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **wmi_recon_running_process_or_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **wmi_recon_running_process_or_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,6 +134,9 @@ network administrator may used this command for checking purposes | 30.0 | 30 | 100 | Suspicious powerShell script execution by $user$ on $ComputerName$ via EventCode 4104, where WMI is performing an event query looking for running processes or running services | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/](https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/) diff --git a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md index 87168ac73e..bab259528f 100644 --- a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md +++ b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md @@ -100,7 +100,7 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons -#### Search +#### Search ``` `sysmon` EventID=20 @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **detect_wmi_event_subscription_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_wmi_event_subscription_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ It is possible some applications will create a consumer and may be required to b | 63.0 | 70 | 90 | Possible malicious WMI Subscription created on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md) diff --git a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md index ff08bba7e0..60c4dcf63e 100644 --- a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md +++ b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md @@ -103,7 +103,7 @@ The following analytic utilizes Windows Event ID 1100 to identify when Windows e -#### Search +#### Search ``` (`wineventlog_security` EventCode=1100) @@ -115,10 +115,11 @@ The following analytic utilizes Windows Event ID 1100 to identify when Windows e #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **suspicious_event_log_service_behavior_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_event_log_service_behavior_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ It is possible the Event Logging service gets shut down due to system errors or | 9.0 | 30 | 30 | The Windows Event Log Service shutdown on $ComputerName$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1100](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1100) diff --git a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md index abea304c9c..f3cb3bed6f 100644 --- a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md +++ b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md @@ -94,7 +94,7 @@ This analytic will identify suspicious process of cscript.exe where it tries to -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **execute_javascript_with_jscript_com_clsid_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **execute_javascript_with_jscript_com_clsid_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ unknown | 56.0 | 80 | 70 | Suspicious process of cscript.exe with a parent process $parent_process_name$ where it tries to execute javascript using jscript.encode CLSID (COM OBJ), detected on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/](https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/) diff --git a/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md b/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md index 70a63baf6b..1385bccfb1 100644 --- a/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md +++ b/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md @@ -94,7 +94,7 @@ This search is to detect a suspicious enabling of smb1protocol through "powershe -#### Search +#### Search ``` `powershell` EventCode=4104 Message = "*Enable-WindowsOptionalFeature*" Message = "*SMB1Protocol*" @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **powershell_enable_smb1protocol_feature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **powershell_enable_smb1protocol_feature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +141,9 @@ network operator may enable or disable this windows feature. | 25.0 | 50 | 50 | Powershell Enable SMB1Protocol Feature | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/](https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/) diff --git a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md index 8eff16ca77..632ad32f31 100644 --- a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md +++ b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md @@ -94,7 +94,7 @@ This search is to detect a suspicious commandline designed to delete files or di -#### Search +#### Search ``` @@ -107,11 +107,12 @@ This search is to detect a suspicious commandline designed to delete files or di #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -Note that **recursive_delete_of_directory_in_batch_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **recursive_delete_of_directory_in_batch_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ network operator may use this batch command to delete recursively a directory or | 25.0 | 50 | 50 | Recursive Delete of Directory In Batch CMD | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/](https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/) diff --git a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md index 9e92cc644c..7c8f2f14f3 100644 --- a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md +++ b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md @@ -94,7 +94,7 @@ This search is to detect a suspicious modification of firewall to allow file and -#### Search +#### Search ``` @@ -108,10 +108,11 @@ This search is to detect a suspicious modification of firewall to allow file and #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **allow_file_and_printing_sharing_in_firewall_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **allow_file_and_printing_sharing_in_firewall_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ network admin may modify this firewall feature that may cause this rule to be tr | 25.0 | 50 | 50 | | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469](https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469) diff --git a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md index 25b9b29b8b..ae402378ab 100644 --- a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md +++ b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md @@ -94,7 +94,7 @@ This search is to detect a suspicious modification to the firewall to allow netw -#### Search +#### Search ``` @@ -108,10 +108,11 @@ This search is to detect a suspicious modification to the firewall to allow netw #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **allow_network_discovery_in_firewall_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **allow_network_discovery_in_firewall_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,6 +149,9 @@ network admin may modify this firewall feature that may cause this rule to be tr | 25.0 | 50 | 50 | | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469](https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469) diff --git a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md index 606308144f..733a0bca06 100644 --- a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md +++ b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md @@ -94,7 +94,7 @@ This search is to detect a suspicious excessive usage of sc.exe in a host machin -#### Search +#### Search ``` `sysmon` EventCode = 1 process_name = "sc.exe" @@ -114,7 +114,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **excessive_usage_of_sc_service_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **excessive_usage_of_sc_service_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ excessive execution of sc.exe is quite suspicious since it can modify or execute | 25.0 | 50 | 50 | Excessive Usage Of SC Service Utility | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/](https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/) diff --git a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md index 8901602ade..5b8f314df8 100644 --- a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md +++ b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md @@ -94,7 +94,7 @@ This detection targets behaviors observed when threat actors have used sc.exe to -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **excessive_number_of_service_control_start_as_disabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **excessive_number_of_service_control_start_as_disabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ Legitimate programs and administrators will execute sc.exe with the start disabl | 80.0 | 80 | 100 | An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create) diff --git a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md index 9b05b4824c..990135e899 100644 --- a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md +++ b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md @@ -105,7 +105,7 @@ During triage, isolate the endpoint and review for source of exploitation. Captu -#### Search +#### Search ``` `printservice` EventCode=316 category = "Adding a printer driver" Message = "*kernelbase.dll,*" Message = "*UNIDRV.DLL,*" Message = "*.DLL.*" @@ -120,7 +120,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) -Note that **print_spooler_adding_a_printer_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **print_spooler_adding_a_printer_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ Unknown. This may require filtering. | 72.0 | 80 | 90 | Suspicious print driver was loaded on endpoint $ComputerName$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://twitter.com/MalwareJake/status/1410421445608476679?s=20](https://twitter.com/MalwareJake/status/1410421445608476679?s=20) diff --git a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md index 162d6b7192..0de92d6264 100644 --- a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md +++ b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md @@ -106,7 +106,7 @@ During triage, isolate the endpoint and review for source of exploitation. Captu -#### Search +#### Search ``` `printservice` ((ErrorCode="0x45A" (EventCode="808" OR EventCode="4909")) OR ("The print spooler failed to load a plug-in module" OR "\\drivers\\x64\\")) @@ -121,7 +121,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) -Note that **print_spooler_failed_to_load_a_plug-in_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **print_spooler_failed_to_load_a_plug-in_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,6 +151,9 @@ False positives are unknown and filtering may be required. | 72.0 | 80 | 90 | Suspicious printer spooler errors have occured on endpoint $ComputerName$ with EventCode $EventCode$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/](https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/) diff --git a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md index a2220926ee..2707a2c100 100644 --- a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md +++ b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md @@ -101,7 +101,7 @@ The following analytic identifies a suspicious child process, `rundll32.exe`, wi -#### Search +#### Search ``` @@ -114,11 +114,12 @@ The following analytic identifies a suspicious child process, `rundll32.exe`, wi #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -Note that **spoolsv_spawning_rundll32_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **spoolsv_spawning_rundll32_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -154,6 +155,9 @@ Limited false positives have been identified. There are limited instances where | 72.0 | 80 | 90 | $parent_process$ has spawned $process_name$ on endpoint $ComputerName$. This behavior is suspicious and related to PrintNightmare. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/](https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/) diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md index e2038ff8b7..4875b9c09f 100644 --- a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md +++ b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md @@ -101,7 +101,7 @@ This search is to detect suspicious loading of dll in specific path relative to -#### Search +#### Search ``` `sysmon` EventCode=7 Image ="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*" ImageLoaded = "*.dll" @@ -117,7 +117,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **spoolsv_suspicious_loaded_modules_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **spoolsv_suspicious_loaded_modules_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ unknown | 72.0 | 80 | 90 | $Image$ with process id $process_id$ has loaded a driver from $ImageLoaded$ on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://raw.githubusercontent.com/hieuttmmo/sigma/dceb13fe3f1821b119ae495b41e24438bd97e3d0/rules/windows/image_load/sysmon_cve_2021_1675_print_nightmare.yml](https://raw.githubusercontent.com/hieuttmmo/sigma/dceb13fe3f1821b119ae495b41e24438bd97e3d0/rules/windows/image_load/sysmon_cve_2021_1675_print_nightmare.yml) diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md index c1d4003c3a..e245f2c50b 100644 --- a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md +++ b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md @@ -94,7 +94,7 @@ This analytic identifies a suspicious behavior related to PrintNightmare, or CVE -#### Search +#### Search ``` `sysmon` EventCode=10 SourceImage = "*\\spoolsv.exe" CallTrace = "*\\Windows\\system32\\spool\\DRIVERS\\x64\\*" TargetImage IN ("*\\rundll32.exe", "*\\spoolsv.exe") GrantedAccess = 0x1fffff @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **spoolsv_suspicious_process_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **spoolsv_suspicious_process_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ Unknown. Filter as needed. | 72.0 | 80 | 90 | $SourceImage$ was GrantedAccess open access to $TargetImage$ on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818](https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818) diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md index 62ecbeca9d..6f69208348 100644 --- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md +++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md @@ -101,7 +101,7 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This -#### Search +#### Search ``` @@ -120,7 +120,8 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **spoolsv_writing_a_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **spoolsv_writing_a_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ Unknown. | 72.0 | 80 | 90 | $process_name$ has been identified writing dll's to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/](https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/) diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md index 97600ba81b..be0e7e75cd 100644 --- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md +++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md @@ -101,7 +101,7 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This -#### Search +#### Search ``` `sysmon` EventID=11 process_name=spoolsv.exe file_path="*\\spool\\drivers\\x64\\*" file_name=*.dll @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **spoolsv_writing_a_dll_-_sysmon_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **spoolsv_writing_a_dll_-_sysmon_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ Limited false positives. Filter as needed. | 72.0 | 80 | 90 | $process_name$ has been identified writing dll's to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818](https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818) diff --git a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md index 6bc36b97f3..d679943795 100644 --- a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md +++ b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md @@ -98,7 +98,7 @@ This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in no -#### Search +#### Search ``` @@ -114,7 +114,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **msmpeng_application_dll_side_loading_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **msmpeng_application_dll_side_loading_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ quite minimal false positive expected. | 25.0 | 50 | 50 | | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://community.sophos.com/b/security-blog/posts/active-ransomware-attack-on-kaseya-customers](https://community.sophos.com/b/security-blog/posts/active-ransomware-attack-on-kaseya-customers) diff --git a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md index 2bfb95a692..df90b856a6 100644 --- a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md +++ b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md @@ -94,7 +94,7 @@ This search is to identifies a modification in registry to disable the windows d -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -Note that **powershell_disable_security_monitoring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **powershell_disable_security_monitoring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,6 +149,9 @@ Limited false positives. However, tune based on scripts that may perform this ac | 25.0 | 50 | 50 | | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell) diff --git a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md index abe989b142..0b6c27f90e 100644 --- a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md +++ b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md @@ -96,7 +96,7 @@ This search is to detect a suspicious loaded unsigned dll by MMC.exe application -#### Search +#### Search ``` `sysmon` EventCode=7 ImageLoaded = "*.dll" Image = "*\\mmc.exe" Signed=false Company != "Microsoft Corporation" @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **uac_bypass_mmc_load_unsigned_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **uac_bypass_mmc_load_unsigned_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ unknown. all of the dll loaded by mmc.exe is microsoft signed dll. | 63.0 | 70 | 90 | Suspicious unsigned $ImageLoaded$ loaded by $Image$ on endpoint $Computer$ with EventCode $EventCode$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://offsec.almond.consulting/UAC-bypass-dotnet.html](https://offsec.almond.consulting/UAC-bypass-dotnet.html) diff --git a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md index bdfab5e39e..eaaa7fc201 100644 --- a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md +++ b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md @@ -104,7 +104,7 @@ This search looks for cloud compute instances created by users who have not crea -#### Search +#### Search ``` @@ -125,7 +125,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **cloud_compute_instance_created_by_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **cloud_compute_instance_created_by_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -159,6 +160,9 @@ It's possible that a user will start to create compute instances for the first t | 18.0 | 30 | 60 | User $user$ is creating a new instance $dest$ for the first time | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-07-19-aws_createloginprofile.md b/docs/_posts/2021-07-19-aws_createloginprofile.md index 8e9c41abb4..3d6e1cf3a4 100644 --- a/docs/_posts/2021-07-19-aws_createloginprofile.md +++ b/docs/_posts/2021-07-19-aws_createloginprofile.md @@ -99,7 +99,7 @@ This search looks for AWS CloudTrail events where a user A(victim A) creates a l -#### Search +#### Search ``` `cloudtrail` eventName = CreateLoginProfile @@ -119,7 +119,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_createloginprofile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_createloginprofile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,6 +149,9 @@ While this search has no known false positives, it is possible that an AWS admin | 72.0 | 90 | 80 | User $user_arn$ is attempting to create a login profile for $requestParameters.userName$ and did a console login from this IP $src_ip$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws](https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws) diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md index b508e4162f..255cfa8075 100644 --- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md +++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md @@ -94,7 +94,7 @@ This search looks for AWS CloudTrail events where a user has created an open/pub -#### Search +#### Search ``` `cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **detect_new_open_s3_buckets_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_new_open_s3_buckets_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ While this search has no known false positives, it is possible that an AWS admin | 48.0 | 60 | 80 | User $user_arn$ has created an open/public bucket $bucketName$ with the following permissions $permission$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md index e0116a224c..b117399a0e 100644 --- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md +++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md @@ -94,7 +94,7 @@ This search looks for AWS CloudTrail events where a user has created an open/pub -#### Search +#### Search ``` `cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **detect_new_open_s3_buckets_over_aws_cli_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_new_open_s3_buckets_over_aws_cli_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ While this search has no known false positives, it is possible that an AWS admin | 48.0 | 60 | 80 | User $userIdentity.userName$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md index d4f466103e..3e3fcac19b 100644 --- a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md +++ b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md @@ -1,6 +1,6 @@ --- title: "Mshta spawning Rundll32 OR Regsvr32 Process" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Mshta " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-07-19 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Mshta - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ This search is to detect a suspicious mshta.exe process that spawn rundll32 or r | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | @@ -94,7 +94,7 @@ This search is to detect a suspicious mshta.exe process that spawn rundll32 or r -#### Search +#### Search ``` @@ -107,12 +107,13 @@ This search is to detect a suspicious mshta.exe process that spawn rundll32 or r #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) -Note that **mshta_spawning_rundll32_or_regsvr32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **mshta_spawning_rundll32_or_regsvr32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,6 +151,9 @@ limitted. this anomaly behavior is not commonly seen in clean host. | 56.0 | 70 | 80 | a mshta parent process $parent_process_name$ spawn child process $process_name$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://twitter.com/cyb3rops/status/1416050325870587910?s=21](https://twitter.com/cyb3rops/status/1416050325870587910?s=21) diff --git a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md index 2303eb5dd5..780879b255 100644 --- a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md +++ b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md @@ -1,6 +1,6 @@ --- title: "Office Product Spawn CMD Process" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Mshta " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-07-19 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Mshta - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ this search is to detect a suspicious office product process that spawn cmd chil | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | @@ -94,7 +94,7 @@ this search is to detect a suspicious office product process that spawn cmd chil -#### Search +#### Search ``` @@ -107,11 +107,12 @@ this search is to detect a suspicious office product process that spawn cmd chil #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -Note that **office_product_spawn_cmd_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **office_product_spawn_cmd_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ IT or network admin may create an document automation that will run shell script | 56.0 | 70 | 80 | an office product parent process $parent_process_name$ spawn child process $process_name$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://twitter.com/cyb3rops/status/1416050325870587910?s=21](https://twitter.com/cyb3rops/status/1416050325870587910?s=21) diff --git a/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md b/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md index 3db74744e6..8a85473aad 100644 --- a/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md +++ b/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md @@ -94,7 +94,7 @@ The following analytic utilizes AWS CloudTrail events to identify when an EC2 sn -#### Search +#### Search ``` `cloudtrail` eventName=ModifySnapshotAttribute @@ -110,7 +110,8 @@ The following analytic utilizes AWS CloudTrail events to identify when an EC2 sn The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **detect_shared_ec2_snapshot_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_shared_ec2_snapshot_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ It is possible that an AWS admin has legitimately shared a snapshot with others | 48.0 | 60 | 80 | AWS EC2 snapshot from account $aws_account_id$ is shared with $requested_account_id$ by user $user_arn$ from $src_ip$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/](https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/) diff --git a/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md b/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md index ea9f20d0d4..961789757b 100644 --- a/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md +++ b/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md @@ -100,7 +100,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It -#### Search +#### Search ``` `powershell` EventCode=4104 Message IN ("*copy*","*[System.IO.File]::Copy*") AND Message IN ("*System32\\config\\SAM*", "*System32\\config\\SYSTEM*","*System32\\config\\SECURITY*") @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **detect_copy_of_shadowcopy_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_copy_of_shadowcopy_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hive | 80.0 | 80 | 100 | PowerShell was identified running a script to capture the SAM hive on endpoint $ComputerName$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934) diff --git a/docs/_posts/2021-07-23-sam_database_file_access_attempt.md b/docs/_posts/2021-07-23-sam_database_file_access_attempt.md index 92e4be7498..d3624aa126 100644 --- a/docs/_posts/2021-07-23-sam_database_file_access_attempt.md +++ b/docs/_posts/2021-07-23-sam_database_file_access_attempt.md @@ -99,7 +99,7 @@ The following analytic identifies access to SAM, SYSTEM or SECURITY databases' w -#### Search +#### Search ``` `wineventlog_security` (EventCode=4663) process_name!=*\\dllhost.exe Object_Name IN ("*\\Windows\\System32\\config\\SAM*","*\\Windows\\System32\\config\\SYSTEM*","*\\Windows\\System32\\config\\SECURITY*") @@ -111,7 +111,8 @@ The following analytic identifies access to SAM, SYSTEM or SECURITY databases' w The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **sam_database_file_access_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **sam_database_file_access_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +141,9 @@ Natively, `dllhost.exe` will access the files. Every environment will have addit | 80.0 | 80 | 100 | The following process $process_name$ accessed the object $Object_Name$ attempting to gain access to credentials on $dest$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4663](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4663) diff --git a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md index edcc9b3a99..f58d7c25f2 100644 --- a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md +++ b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md @@ -90,7 +90,7 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe -#### Search +#### Search ``` `sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage IN ("*\\firefox.exe", "*\\chrome.exe", "*\\iexplore.exe","*\\microsoftedgecp.exe") @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **rundll32_createremotethread_in_browser_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **rundll32_createremotethread_in_browser_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ unknown | 70.0 | 70 | 100 | rundl32 process $SourceImage$ create a remote thread to browser process $TargetImage$ in host $Computer$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.joesandbox.com/analysis/380662/0/html](https://www.joesandbox.com/analysis/380662/0/html) diff --git a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md index 7a1f4d1a29..993cddca30 100644 --- a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md +++ b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md @@ -1,6 +1,6 @@ --- title: "Rundll32 Process Creating Exe Dll Files" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Rundll32 " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-07-26 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Rundll32 - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ This search is to detect a suspicious rundll32 process that drops executable (.e | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | @@ -94,7 +94,7 @@ This search is to detect a suspicious rundll32 process that drops executable (.e -#### Search +#### Search ``` `sysmon` EventCode=11 process_name="rundll32.exe" TargetFilename IN ("*.exe", "*.dll",) @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **rundll32_process_creating_exe_dll_files_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **rundll32_process_creating_exe_dll_files_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +141,9 @@ unknown | 80.0 | 80 | 100 | rundll32 process $process_name$ drops a file $TargetFilename$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://any.run/malware-trends/icedid](https://any.run/malware-trends/icedid) diff --git a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md index f58a5f03f1..3f9df63f45 100644 --- a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md +++ b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md @@ -1,6 +1,6 @@ --- title: "Suspicious IcedID Rundll32 Cmdline" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Rundll32 " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-07-26 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Rundll32 - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ This search is to detect a suspicious rundll32.exe commandline to execute dll fi | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | @@ -94,7 +94,7 @@ This search is to detect a suspicious rundll32.exe commandline to execute dll fi -#### Search +#### Search ``` @@ -107,11 +107,12 @@ This search is to detect a suspicious rundll32.exe commandline to execute dll fi #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -Note that **suspicious_icedid_rundll32_cmdline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_icedid_rundll32_cmdline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,6 +149,9 @@ limitted. this parameter is not commonly used by windows application but can be | 56.0 | 70 | 80 | rundll32 process $process_name$ with commandline $process$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/](https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/) diff --git a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md index 9e2e2c4bda..177bc415ac 100644 --- a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md +++ b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md @@ -1,6 +1,6 @@ --- title: "Suspicious Rundll32 PluginInit" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Rundll32 " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-07-26 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Rundll32 - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ This search is to detect a suspicious rundll32.exe process with plugininit param | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | @@ -94,7 +94,7 @@ This search is to detect a suspicious rundll32.exe process with plugininit param -#### Search +#### Search ``` @@ -107,11 +107,12 @@ This search is to detect a suspicious rundll32.exe process with plugininit param #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -Note that **suspicious_rundll32_plugininit_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_rundll32_plugininit_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ third party application may used this dll export name to execute function. | 42.0 | 60 | 70 | rundll32 process $process_name$ with commandline $process$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/](https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/) diff --git a/docs/_posts/2021-07-27-chcp_command_execution.md b/docs/_posts/2021-07-27-chcp_command_execution.md index cda3752e48..41dea20230 100644 --- a/docs/_posts/2021-07-27-chcp_command_execution.md +++ b/docs/_posts/2021-07-27-chcp_command_execution.md @@ -89,7 +89,7 @@ This search is to detect execution of chcp.exe application. this utility is used -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **chcp_command_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **chcp_command_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ other tools or script may used this to change code page to UTF-* or others | 9.0 | 30 | 30 | parent process $parent_process_name$ spawning chcp process $process_name$ with parent command line $parent_process$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://ss64.com/nt/chcp.html](https://ss64.com/nt/chcp.html) diff --git a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md index d8a6f7c4e3..2e3b898fa8 100644 --- a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md +++ b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md @@ -1,6 +1,6 @@ --- title: "Regsvr32 with Known Silent Switch Cmdline" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Regsvr32 " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-07-27 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Regsvr32 - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ The following analytic identifies Regsvr32.exe utilizing the silent switch to lo | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.010](https://attack.mitre.org/techniques/T1218/010/) | Regsvr32 | Defense Evasion | @@ -94,7 +94,7 @@ The following analytic identifies Regsvr32.exe utilizing the silent switch to lo -#### Search +#### Search ``` @@ -113,7 +113,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) -Note that **regsvr32_with_known_silent_switch_cmdline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **regsvr32_with_known_silent_switch_cmdline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,6 +153,9 @@ minimal. but network operator can use this application to load dll. | 56.0 | 70 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a DLL using the silent parameter. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://app.any.run/tasks/56680cba-2bbc-4b34-8633-5f7878ddf858/](https://app.any.run/tasks/56680cba-2bbc-4b34-8633-5f7878ddf858/) diff --git a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md index 21309bd263..362a49e360 100644 --- a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md +++ b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md @@ -90,7 +90,7 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe -#### Search +#### Search ``` `sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage = "*.exe" @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **rundll32_create_remote_thread_to_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **rundll32_create_remote_thread_to_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ unknown | 56.0 | 70 | 80 | rundl32 process $SourceImage$ create a remote thread to process $TargetImage$ in host $Computer$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.joesandbox.com/analysis/380662/0/html](https://www.joesandbox.com/analysis/380662/0/html) diff --git a/docs/_posts/2021-07-30-drop_icedid_license_dat.md b/docs/_posts/2021-07-30-drop_icedid_license_dat.md index bbef2ca9c7..6947deb0b4 100644 --- a/docs/_posts/2021-07-30-drop_icedid_license_dat.md +++ b/docs/_posts/2021-07-30-drop_icedid_license_dat.md @@ -94,7 +94,7 @@ This search is to detect dropping a suspicious file named as "license.dat" in %a -#### Search +#### Search ``` `sysmon` EventCode= 11 TargetFilename = "*\\license.dat" AND (TargetFilename="*\\appdata\\*" OR TargetFilename="*\\programdata\\*") @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **drop_icedid_license_dat_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **drop_icedid_license_dat_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,6 +135,9 @@ unknown | 63.0 | 70 | 90 | process $SourceImage$ create a file $TargetImage$ in host $Computer$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.cisecurity.org/white-papers/security-primer-icedid/](https://www.cisecurity.org/white-papers/security-primer-icedid/) diff --git a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md index 27ed29803d..b2ae22d47e 100644 --- a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md +++ b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md @@ -94,7 +94,7 @@ This search is to detect a suspicious file creation namely passff.tar and cookie -#### Search +#### Search ``` `sysmon` EventCode= 11 (TargetFilename = "*\\passff.tar" OR TargetFilename = "*\\cookie.tar") @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **icedid_exfiltrated_archived_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **icedid_exfiltrated_archived_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ unknown | 72.0 | 80 | 90 | process $SourceImage$ create a file $TargetImage$ in host $Computer$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.cisecurity.org/white-papers/security-primer-icedid/](https://www.cisecurity.org/white-papers/security-primer-icedid/) diff --git a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md index b05f571e6c..4ea62893dc 100644 --- a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md +++ b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md @@ -94,7 +94,7 @@ this detection was designed to identifies suspicious spawned process of known MS -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) -Note that **office_application_spawn_regsvr32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **office_application_spawn_regsvr32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ unknown | 63.0 | 70 | 90 | Office application spawning regsvr32.exe on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.joesandbox.com/analysis/380662/0/html](https://www.joesandbox.com/analysis/380662/0/html) diff --git a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md index 2a1c40d67a..56eefd871f 100644 --- a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md +++ b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md @@ -89,7 +89,7 @@ This search is to detect a suspicious file creation of sqlite3.dll in %temp% fol -#### Search +#### Search ``` `sysmon` EventCode=11 (TargetFilename = "*\\sqlite32.dll" OR TargetFilename = "*\\sqlite64.dll") (TargetFilename = "*\\temp\\*") @@ -104,7 +104,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **sqlite_module_in_temp_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **sqlite_module_in_temp_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,6 +135,9 @@ unknown | 9.0 | 30 | 30 | process $SourceImage$ create a file $TargetImage$ in host $Computer$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.cisecurity.org/white-papers/security-primer-icedid/](https://www.cisecurity.org/white-papers/security-primer-icedid/) diff --git a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md index 690b7c5458..29c7c303cc 100644 --- a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md +++ b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md @@ -90,7 +90,7 @@ This search is to detect suspicious process injection in command shell. This tec -#### Search +#### Search ``` `sysmon` EventCode=8 TargetImage IN ("*\\cmd.exe", "*\\powershell*") @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **create_remote_thread_in_shell_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **create_remote_thread_in_shell_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ unknown | 70.0 | 70 | 100 | process $SourceImage$ create a remote thread to shell app process $TargetImage$ in host $Computer$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus/](https://thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus/) diff --git a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md index cd02c25ca7..ab143a2843 100644 --- a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md +++ b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md @@ -1,7 +1,7 @@ --- title: "Uninstall App Using MsiExec" excerpt: "Msiexec -, Signed Binary Proxy Execution +, System Binary Proxy Execution " categories: - Endpoint @@ -10,7 +10,7 @@ toc: true toc_label: "" tags: - Msiexec - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Defense Evasion - Defense Evasion - Splunk Enterprise @@ -47,7 +47,7 @@ This search is to detect a suspicious un-installation of application using msiex | -------------- | ---------------- |-------------------- | | [T1218.007](https://attack.mitre.org/techniques/T1218/007/) | Msiexec | Defense Evasion | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | @@ -94,7 +94,7 @@ This search is to detect a suspicious un-installation of application using msiex -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **uninstall_app_using_msiexec_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **uninstall_app_using_msiexec_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ unknown. | 30.0 | 50 | 60 | process $process_name$ with a cmdline $process$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://threadreaderapp.com/thread/1423361119926816776.html](https://threadreaderapp.com/thread/1423361119926816776.html) diff --git a/docs/_posts/2021-08-11-fsutil_zeroing_file.md b/docs/_posts/2021-08-11-fsutil_zeroing_file.md index 27cc04d046..ed61f1ec08 100644 --- a/docs/_posts/2021-08-11-fsutil_zeroing_file.md +++ b/docs/_posts/2021-08-11-fsutil_zeroing_file.md @@ -89,7 +89,7 @@ This search is to detect a suspicious fsutil process to zeroing a target file. T -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **fsutil_zeroing_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **fsutil_zeroing_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,6 +137,9 @@ unknown | 54.0 | 60 | 90 | Possible file data deletion on $dest$ using $process$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/](https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/) diff --git a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md index 9deb8476b4..e392129664 100644 --- a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md +++ b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md @@ -1,6 +1,6 @@ --- title: "UAC Bypass With Colorui COM Object" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , CMSTP " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-08-13 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - CMSTP - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ This search is to detect a possible uac bypass using the colorui.dll COM Object. | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.003](https://attack.mitre.org/techniques/T1218/003/) | CMSTP | Defense Evasion | @@ -94,7 +94,7 @@ This search is to detect a possible uac bypass using the colorui.dll COM Object. -#### Search +#### Search ``` `sysmon` EventCode=7 ImageLoaded="*\\colorui.dll" process_name != "colorcpl.exe" NOT(Image IN("*\\windows\\*", "*\\program files*")) @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **uac_bypass_with_colorui_com_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **uac_bypass_with_colorui_com_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ not so common. but 3rd part app may load this dll. | 48.0 | 60 | 80 | The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $Computer$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/](https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/) diff --git a/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md b/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md index 4f31b3e77e..b08be20bfd 100644 --- a/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md +++ b/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md @@ -93,7 +93,7 @@ This search is to detect suspicious google drive or google docs files shared out -#### Search +#### Search ``` `gsuite_drive` NOT (email IN("", "null")) @@ -114,7 +114,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [gsuite_drive](https://github.com/splunk/security_content/blob/develop/macros/gsuite_drive.yml) -Note that **gsuite_drive_share_in_external_email_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **gsuite_drive_share_in_external_email_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ network admin or normal user may share files to customer and external team. | 72.0 | 80 | 90 | suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.redhat.com/en/topics/devops/what-is-devsecops](https://www.redhat.com/en/topics/devops/what-is-devsecops) diff --git a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md index 17744a84ce..febbd50d89 100644 --- a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md +++ b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md @@ -93,7 +93,7 @@ This search is to detect a suspicious attachment file extension in Gsuite email -#### Search +#### Search ``` `gsuite_gmail` "attachment{}.file_extension_type" IN ("pl", "py", "rb", "sh", "bat", "exe", "dll", "cpl", "com", "js", "vbs", "ps1", "reg","swf", "cmd", "go") @@ -107,10 +107,11 @@ This search is to detect a suspicious attachment file extension in Gsuite email #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **gsuite_email_suspicious_attachment_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **gsuite_email_suspicious_attachment_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ network admin and normal user may send this file attachment as part of their day | 49.0 | 70 | 70 | suspicious email from $source.address$ to $destination{}.address$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.redhat.com/en/topics/devops/what-is-devsecops](https://www.redhat.com/en/topics/devops/what-is-devsecops) diff --git a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md index a635ae1288..2afe23010a 100644 --- a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md +++ b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md @@ -94,7 +94,7 @@ This search is to detect a suspicious 7z process with commandline pointing to SM -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **7zip_commandline_to_smb_share_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **7zip_commandline_to_smb_share_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ unknown | 25.0 | 50 | 50 | archive process $process_name$ with suspicious cmdline $process$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://threadreaderapp.com/thread/1423361119926816776.html](https://threadreaderapp.com/thread/1423361119926816776.html) diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md index 7fbeb466a4..e1da50fddc 100644 --- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md +++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md @@ -99,7 +99,7 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( -#### Search +#### Search ``` `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings @@ -122,7 +122,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_ecr_container_scanning_findings_high_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_ecr_container_scanning_findings_high_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * eventSource @@ -155,6 +156,9 @@ unknown | 70.0 | 70 | 100 | Vulnerabilities with severity high found in image $image$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html](https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html) diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md index 4ffe66029c..718480f17c 100644 --- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md +++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md @@ -99,7 +99,7 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( -#### Search +#### Search ``` `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings @@ -122,7 +122,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_ecr_container_scanning_findings_low_informational_unknown_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_ecr_container_scanning_findings_low_informational_unknown_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * eventSource @@ -155,6 +156,9 @@ unknown | 7.0 | 10 | 70 | Vulnerabilities with severity high found in repository $repositoryName$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html](https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html) diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md index e6ac3352d8..391be517c1 100644 --- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md +++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md @@ -99,7 +99,7 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( -#### Search +#### Search ``` `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings @@ -122,7 +122,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_ecr_container_scanning_findings_medium_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_ecr_container_scanning_findings_medium_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * eventSource @@ -155,6 +156,9 @@ unknown | 21.0 | 30 | 70 | Vulnerabilities with severity high found in image $image$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html](https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html) diff --git a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md index 25b17452af..2ad0c1e6d9 100644 --- a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md +++ b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md @@ -1,6 +1,6 @@ --- title: "Gsuite Outbound Email With Attachment To External Domain" -excerpt: "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol +excerpt: "Exfiltration Over Unencrypted Non-C2 Protocol , Exfiltration Over Alternative Protocol " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-08-17 toc: true toc_label: "" tags: - - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol + - Exfiltration Over Unencrypted Non-C2 Protocol - Exfiltration Over Alternative Protocol - Exfiltration - Exfiltration @@ -44,7 +44,7 @@ This search is to detect a suspicious outbound e-mail from internal email to ext | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration | +| [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted Non-C2 Protocol | Exfiltration | | [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration | @@ -93,7 +93,7 @@ This search is to detect a suspicious outbound e-mail from internal email to ext -#### Search +#### Search ``` `gsuite_gmail` num_message_attachments > 0 @@ -112,10 +112,11 @@ This search is to detect a suspicious outbound e-mail from internal email to ext #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **gsuite_outbound_email_with_attachment_to_external_domain_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **gsuite_outbound_email_with_attachment_to_external_domain_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ network admin and normal user may send this file attachment as part of their day | 9.0 | 30 | 30 | suspicious email from $source.address$ to $destination{}.address$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.redhat.com/en/topics/devops/what-is-devsecops](https://www.redhat.com/en/topics/devops/what-is-devsecops) diff --git a/docs/_posts/2021-08-18-esentutl_sam_copy.md b/docs/_posts/2021-08-18-esentutl_sam_copy.md index a007942dd8..3e485afea0 100644 --- a/docs/_posts/2021-08-18-esentutl_sam_copy.md +++ b/docs/_posts/2021-08-18-esentutl_sam_copy.md @@ -94,7 +94,7 @@ The following analytic identifies the process - `esentutl.exe` - being used to c -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_esentutl](https://github.com/splunk/security_content/blob/develop/macros/process_esentutl.yml) -Note that **esentutl_sam_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **esentutl_sam_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,6 +149,9 @@ False positives should be limited. Filter as needed. | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user user$ attempting to capture credentials for offline cracking or observability. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/6a570c2a4630cf0c2bd41a2e8375b5d5ab92f700/atomics/T1003.002/T1003.002.md](https://github.com/redcanaryco/atomic-red-team/blob/6a570c2a4630cf0c2bd41a2e8375b5d5ab92f700/atomics/T1003.002/T1003.002.md) diff --git a/docs/_posts/2021-08-18-powershell_4104_hunting.md b/docs/_posts/2021-08-18-powershell_4104_hunting.md index 1351608297..219aefe986 100644 --- a/docs/_posts/2021-08-18-powershell_4104_hunting.md +++ b/docs/_posts/2021-08-18-powershell_4104_hunting.md @@ -93,7 +93,7 @@ The following Hunting analytic assists with identifying suspicious PowerShell ex -#### Search +#### Search ``` `powershell` EventCode=4104 @@ -281,7 +281,8 @@ The following Hunting analytic assists with identifying suspicious PowerShell ex The SPL above uses the following Macros: * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **powershell_4104_hunting_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **powershell_4104_hunting_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -308,6 +309,9 @@ Limited false positives. May filter as needed. | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing suspicious commands. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md](https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md) diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md index effe7bbb6f..b17517c6c9 100644 --- a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md +++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md @@ -99,7 +99,7 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( -#### Search +#### Search ``` `cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage date_hour>=20 OR date_hour<8 NOT (date_wday=saturday OR date_wday=sunday) @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_ecr_container_upload_outside_business_hours_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_ecr_container_upload_outside_business_hours_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * eventSource @@ -151,6 +152,9 @@ When your development is spreaded in different time zones, applying this rule ca | 49.0 | 70 | 70 | Container uploaded outside business hours from $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1204/003/](https://attack.mitre.org/techniques/T1204/003/) diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md index 82fc892395..06cd8ffc15 100644 --- a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md +++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md @@ -99,7 +99,7 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( -#### Search +#### Search ``` `cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage NOT `aws_ecr_users` @@ -115,11 +115,12 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### Macros The SPL above uses the following Macros: -* [aws_ecr_users](https://github.com/splunk/security_content/blob/develop/macros/aws_ecr_users.yml) -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [aws_ecr_users](https://github.com/splunk/security_content/blob/develop/macros/aws_ecr_users.yml) -Note that **aws_ecr_container_upload_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_ecr_container_upload_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * eventSource @@ -152,6 +153,9 @@ unknown | 49.0 | 70 | 70 | Container uploaded from unknown user $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1204/003/](https://attack.mitre.org/techniques/T1204/003/) diff --git a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md index 5a7caf6cc8..a12eb88c2b 100644 --- a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md +++ b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md @@ -93,7 +93,7 @@ This search is to detect a gsuite email contains suspicious subject having known -#### Search +#### Search ``` `gsuite_gmail` num_message_attachments > 0 subject IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "* fedex *", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") attachment{}.file_extension_type IN ("doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "zip", "rar", "html","htm","hta") @@ -110,10 +110,11 @@ This search is to detect a gsuite email contains suspicious subject having known #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **gsuite_email_suspicious_subject_with_attachment_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **gsuite_email_suspicious_subject_with_attachment_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ normal user or normal transaction may contain the subject and file type attachme | 25.0 | 50 | 50 | suspicious email from $source.address$ to $destination{}.address$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.redhat.com/en/topics/devops/what-is-devsecops](https://www.redhat.com/en/topics/devops/what-is-devsecops) diff --git a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md index bf5d4f35cf..fe24c22ef8 100644 --- a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md +++ b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md @@ -13,7 +13,7 @@ tags: - Network_Traffic --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -92,7 +92,7 @@ The following analytic identifies cleartext protocols at risk of leaking sensiti -#### Search +#### Search ``` @@ -108,7 +108,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **protocols_passing_authentication_in_cleartext_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **protocols_passing_authentication_in_cleartext_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ Some networks may use kerberized FTP or telnet servers, however, this is rare. | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.rackaid.com/blog/secure-your-email-and-file-transfers/](https://www.rackaid.com/blog/secure-your-email-and-file-transfers/) diff --git a/docs/_posts/2021-08-20-github_commit_changes_in_master.md b/docs/_posts/2021-08-20-github_commit_changes_in_master.md index f030da7087..45fc019461 100644 --- a/docs/_posts/2021-08-20-github_commit_changes_in_master.md +++ b/docs/_posts/2021-08-20-github_commit_changes_in_master.md @@ -88,7 +88,7 @@ This search is to detect a pushed or commit to master or main branch. This is to -#### Search +#### Search ``` `github` branches{}.name = main OR branches{}.name = master @@ -104,7 +104,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) -Note that **github_commit_changes_in_master_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **github_commit_changes_in_master_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -129,6 +130,9 @@ admin can do changes directly to master branch | 9.0 | 30 | 30 | suspicious commit by $commit.commit.author.email$ to main branch | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.redhat.com/en/topics/devops/what-is-devsecops](https://www.redhat.com/en/topics/devops/what-is-devsecops) diff --git a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md index 60a79c22ea..a57a6286ea 100644 --- a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md +++ b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md @@ -94,7 +94,7 @@ This search uses the Kubernetes logs from a nginx ingress controller to detect l -#### Search +#### Search ``` `kubernetes_container_controller` @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [kubernetes_container_controller](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_container_controller.yml) -Note that **kubernetes_nginx_ingress_lfi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kubernetes_nginx_ingress_lfi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -146,6 +147,9 @@ unknown | 49.0 | 70 | 70 | Local File Inclusion Attack detected on $host$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/splunk/splunk-connect-for-kubernetes](https://github.com/splunk/splunk-connect-for-kubernetes) diff --git a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md index 6c3da7bafd..6f4e1e443f 100644 --- a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md +++ b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md @@ -94,7 +94,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **getlocaluser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **getlocaluser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,6 +136,9 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo | 15.0 | 30 | 50 | Local user discovery enumeration using PowerShell on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1087/001/](https://attack.mitre.org/techniques/T1087/001/) diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md index 2c8ab1f08b..37b775da8a 100644 --- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md +++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md @@ -94,7 +94,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **getwmiobject_user_account_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **getwmiobject_user_account_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,6 +136,9 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo | 15.0 | 30 | 50 | Local user discovery enumeration using PowerShell on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1087/001/](https://attack.mitre.org/techniques/T1087/001/) diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md index f302c6ef35..aa74fdd0d4 100644 --- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md +++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md @@ -93,7 +93,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 (Message="*Get-WmiObject*" AND Message="*Win32_UserAccount*") @@ -107,7 +107,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **getwmiobject_user_account_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **getwmiobject_user_account_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,6 +133,9 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo | 15.0 | 30 | 50 | Local user discovery enumeration using PowerShell on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1087/001/](https://attack.mitre.org/techniques/T1087/001/) diff --git a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md index 8b103245dd..068bd0ccde 100644 --- a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md +++ b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md @@ -93,7 +93,7 @@ This analytics is to detect a gmail containing a link that are known to be abuse -#### Search +#### Search ``` `gsuite_gmail` "link_domain{}" IN ("*pastebin.com*", "*discord*", "*telegram*","t.me") @@ -110,10 +110,11 @@ This analytics is to detect a gmail containing a link that are known to be abuse #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **gsuite_email_with_known_abuse_web_service_link_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **gsuite_email_with_known_abuse_web_service_link_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ normal email contains this link that are known application within the organizati | 25.0 | 50 | 50 | suspicious email from $source.address$ to $destination{}.address$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/](https://news.sophos.com/en-us/2021/07/22/malware-increasingly-targets-discord-for-abuse/) diff --git a/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md b/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md index 2982d668b0..f58bbdb3e4 100644 --- a/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md +++ b/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md @@ -93,7 +93,7 @@ This search is to detect a shared file in google drive with suspicious file name -#### Search +#### Search ``` `gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title" IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*", "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*", "*new order*") parameters.doc_type IN ("document","pdf", "msexcel", "msword", "spreadsheet", "presentation") @@ -114,7 +114,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [gsuite_drive](https://github.com/splunk/security_content/blob/develop/macros/gsuite_drive.yml) -Note that **gsuite_suspicious_shared_file_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **gsuite_suspicious_shared_file_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ normal user or normal transaction may contain the subject and file type attachme | 21.0 | 30 | 70 | suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.redhat.com/en/topics/devops/what-is-devsecops](https://www.redhat.com/en/topics/devops/what-is-devsecops) diff --git a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md index d4ff423a2a..abc9e85d93 100644 --- a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md +++ b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md @@ -94,7 +94,7 @@ This search uses the Kubernetes logs from a nginx ingress controller to detect r -#### Search +#### Search ``` `kubernetes_container_controller` @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [kubernetes_container_controller](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_container_controller.yml) -Note that **kubernetes_nginx_ingress_rfi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kubernetes_nginx_ingress_rfi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * raw @@ -141,6 +142,9 @@ unknown | 49.0 | 70 | 70 | Remote File Inclusion Attack detected on $host$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/splunk/splunk-connect-for-kubernetes](https://github.com/splunk/splunk-connect-for-kubernetes) diff --git a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md index b1e3d7bf2d..b6db865c9e 100644 --- a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md +++ b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md @@ -93,7 +93,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 Message = "*[adsisearcher]*" Message = "*objectcategory=user*" Message = "*.findAll()*" @@ -108,7 +108,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **adsisearcher_account_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **adsisearcher_account_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ Administrators or power users may use this command for troubleshooting. | 25.0 | 50 | 50 | powershell process having commandline $Message$ for user enumeration | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1087/002/](https://attack.mitre.org/techniques/T1087/002/) diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md index 1e4f5c1587..6f5fb9b8f6 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md @@ -94,7 +94,7 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **domain_account_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **domain_account_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ Administrators or power users may use this command for troubleshooting. | 25.0 | 50 | 50 | an instance of process $process_name$ with commandline $process$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm](https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm) diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md index bc2538d871..b8fbf4fb1d 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md @@ -94,7 +94,7 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li -#### Search +#### Search ``` @@ -108,10 +108,11 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -Note that **domain_account_discovery_with_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **domain_account_discovery_with_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ Administrators or power users may use this command for troubleshooting. | 25.0 | 50 | 50 | an instance of process $process_name$ with commandline $process$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.microsoft.com/en-us/defender-for-identity/playbook-domain-dominance](https://docs.microsoft.com/en-us/defender-for-identity/playbook-domain-dominance) diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md index abd649d221..717081311d 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md @@ -94,7 +94,7 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **domain_account_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **domain_account_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ Administrators or power users may use this command for troubleshooting. | 25.0 | 50 | 50 | an instance of process $process_name$ with commandline $process$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1087/002/](https://attack.mitre.org/techniques/T1087/002/) diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md index 81b5468eae..35bb1f0ef5 100644 --- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md +++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md @@ -89,7 +89,7 @@ This analytic identifies Get-DomainTrust from PowerView in order to gather domai -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **get-domaintrust_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **get-domaintrust_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ Limited false positives as this requires an active Administrator or adversary to | 12.0 | 30 | 40 | Suspicious PowerShell Get-DomainTrust was identified on endpoint $dest$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/](http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/) diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md index 2cbd51a97a..70a156d87f 100644 --- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md @@ -90,7 +90,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It -#### Search +#### Search ``` `powershell` EventCode=4104 Message = "*get-foresttrust*" @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **get-domaintrust_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **get-domaintrust_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,6 +137,9 @@ It is possible certain system management frameworks utilize this command to gath | 12.0 | 30 | 40 | Suspicious PowerShell Get-DomainTrust was identified on endpoint $ComputerName$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/](http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/) diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell.md b/docs/_posts/2021-08-24-get_aduser_with_powershell.md index 8c55c49f74..8eaf88a876 100644 --- a/docs/_posts/2021-08-24-get_aduser_with_powershell.md +++ b/docs/_posts/2021-08-24-get_aduser_with_powershell.md @@ -94,7 +94,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **get_aduser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **get_aduser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ Administrators or power users may use this command for troubleshooting. | 25.0 | 50 | 50 | an instance of process $process_name$ with commandline $process$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.blackhillsinfosec.com/red-blue-purple/](https://www.blackhillsinfosec.com/red-blue-purple/) diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md b/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md index ff5ebb86ac..9620e03b45 100644 --- a/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md @@ -93,7 +93,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 Message = "*get-aduser*" Message = "*-filter*" @@ -108,7 +108,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **get_aduser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **get_aduser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ Administrators or power users may use this command for troubleshooting. | 25.0 | 50 | 50 | powershell process having commandline $Message$ for user enumeration | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.blackhillsinfosec.com/red-blue-purple/](https://www.blackhillsinfosec.com/red-blue-purple/) diff --git a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md index 3a52de44f6..e5da98060b 100644 --- a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md +++ b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md @@ -94,7 +94,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **get_domainuser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **get_domainuser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ Administrators or power users may use this command for troubleshooting. | 25.0 | 50 | 50 | an instance of process $process_name$ with commandline $process$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/](https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/) diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md index b56e0c0891..8a33e69b41 100644 --- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md +++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md @@ -94,7 +94,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **getwmiobject_ds_user_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **getwmiobject_ds_user_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ Administrators or power users may use this command for troubleshooting. | 25.0 | 50 | 50 | an instance of process $process_name$ with commandline $process$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm](https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm) diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md index 8f67e8654a..7187d4584c 100644 --- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md @@ -93,7 +93,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 Message = "*get-wmiobject*" Message = "*ds_user*" Message = "*-namespace*" Message = "*root\\directory\\ldap*" @@ -108,7 +108,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **getwmiobject_ds_user_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **getwmiobject_ds_user_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ Administrators or power users may use this command for troubleshooting. | 25.0 | 50 | 50 | powershell process having commandline $Message$ for user enumeration | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.blackhillsinfosec.com/red-blue-purple/](https://www.blackhillsinfosec.com/red-blue-purple/) diff --git a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md index 1abaeec562..7de89a590d 100644 --- a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md +++ b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md @@ -94,7 +94,7 @@ This search uses the Kubernetes logs from Splunk Connect from Kubernetes to dete -#### Search +#### Search ``` `kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*") @@ -111,10 +111,11 @@ This search uses the Kubernetes logs from Splunk Connect from Kubernetes to dete #### Macros The SPL above uses the following Macros: -* [kube_objects_events](https://github.com/splunk/security_content/blob/develop/macros/kube_objects_events.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [kube_objects_events](https://github.com/splunk/security_content/blob/develop/macros/kube_objects_events.yml) -Note that **kubernetes_scanner_image_pulling_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kubernetes_scanner_image_pulling_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * object.message @@ -145,6 +146,9 @@ unknown | 81.0 | 90 | 90 | Kubernetes Scanner image pulled on host $host$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/splunk/splunk-connect-for-kubernetes](https://github.com/splunk/splunk-connect-for-kubernetes) diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md b/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md index 0b666e17df..03b2aed80b 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md @@ -93,7 +93,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 (Message = "*[adsisearcher]*" AND Message = "*(objectcategory=group)*" AND Message = "*findAll()*") @@ -107,7 +107,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **domain_group_discovery_with_adsisearcher_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **domain_group_discovery_with_adsisearcher_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,6 +137,9 @@ Administrators or power users may use Adsisearcher for troubleshooting. | 18.0 | 30 | 60 | Domain group discovery enumeration using PowerShell on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/) diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md index 4e1923add4..00b79fcfc2 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md @@ -94,7 +94,7 @@ This analytic looks for the execution of `net.exe` with command-line arguments u -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **domain_group_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **domain_group_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -145,6 +146,9 @@ Administrators or power users may use this command for troubleshooting. | 15.0 | 30 | 50 | Domain group discovery enumeration on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/) diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md index 057c7b9eb8..cfe1fbe893 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md @@ -94,7 +94,7 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **domain_group_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **domain_group_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -145,6 +146,9 @@ Administrators or power users may use this command for troubleshooting. | 15.0 | 30 | 50 | Domain group discovery enumeration on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/) diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md index 3dcee48e73..7a98b87ff9 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md @@ -94,7 +94,7 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-l -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **elevated_group_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **elevated_group_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -145,6 +146,9 @@ Administrators or power users may use this command for troubleshooting. | 21.0 | 30 | 70 | Elevated domain group discovery enumeration on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/) diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md index d4a0e4207f..2def8308ba 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md @@ -93,7 +93,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 (Message = "*Get-DomainGroupMember*") AND Message IN ("*Domain Admins*","*Enterprise Admins*", "*Schema Admins*", "*Account Operators*" , "*Server Operators*", "*Protected Users*", "*Dns Admins*") @@ -107,7 +107,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **elevated_group_discovery_with_powerview_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **elevated_group_discovery_with_powerview_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,6 +137,9 @@ Administrators or power users may use this PowerView for troubleshooting. | 21.0 | 30 | 70 | Elevated group discovery using PowerView on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/) diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md index 9e74477f9c..765e6a564e 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md @@ -94,7 +94,7 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **elevated_group_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **elevated_group_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -145,6 +146,9 @@ Administrators or power users may use this command for troubleshooting. | 21.0 | 30 | 70 | Elevated domain group discovery enumeration on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/) diff --git a/docs/_posts/2021-08-25-getadgroup_with_powershell.md b/docs/_posts/2021-08-25-getadgroup_with_powershell.md index 14f6507392..d93a9301f1 100644 --- a/docs/_posts/2021-08-25-getadgroup_with_powershell.md +++ b/docs/_posts/2021-08-25-getadgroup_with_powershell.md @@ -94,7 +94,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **getadgroup_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **getadgroup_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -145,6 +146,9 @@ Administrators or power users may use this command for troubleshooting. | 15.0 | 30 | 50 | Domain group discovery enumeration on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/) diff --git a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md index ae1061da83..d7c7fd7844 100644 --- a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md +++ b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md @@ -94,7 +94,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **getdomaingroup_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **getdomaingroup_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -145,6 +146,9 @@ Administrators or power users may use this command for troubleshooting. | 15.0 | 30 | 50 | Domain group discovery with PowerView on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/) diff --git a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md index 76016aa17f..ba119b23d5 100644 --- a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md +++ b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md @@ -89,7 +89,7 @@ This analytic looks for the execution of `powershell.exe` with command-line util -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **getnettcpconnection_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **getnettcpconnection_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -140,6 +141,9 @@ Administrators or power users may use this command for troubleshooting. | 15.0 | 30 | 50 | Network Connection discovery on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1049/](https://attack.mitre.org/techniques/T1049/) diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md index 0fafe5b196..6579964100 100644 --- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md +++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md @@ -94,7 +94,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **getwmiobject_ds_group_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **getwmiobject_ds_group_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -145,6 +146,9 @@ Administrators or power users may use this command for troubleshooting. | 15.0 | 30 | 50 | Domain group discovery enumeration on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/) diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md index 5c78ddd586..2c52556a68 100644 --- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md +++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md @@ -93,7 +93,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace root\\directory\\ldap*" AND Message="*class ds_group*") @@ -107,7 +107,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **getwmiobject_ds_group_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **getwmiobject_ds_group_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,6 +137,9 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo | 15.0 | 30 | 50 | Domain group discovery enumeration using PowerShell on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/) diff --git a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md index 796be443e6..5b591105ca 100644 --- a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md @@ -89,7 +89,7 @@ This analytic looks for the execution of `powershell.exe` executing the Get-ADDe -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **get_addefaultdomainpasswordpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **get_addefaultdomainpasswordpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ Administrators or power users may use this command for troubleshooting. | 9.0 | 30 | 30 | an instance of process $process_name$ with commandline $process$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet) diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md index ffc357382f..c66a73593d 100644 --- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md @@ -89,7 +89,7 @@ This analytic looks for the execution of `powershell.exe` executing the Get ADUs -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **get_aduserresultantpasswordpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **get_aduserresultantpasswordpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ Administrators or power users may use this command for troubleshooting. | 25.0 | 50 | 50 | an instance of process $process_name$ with commandline $process$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet) diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md index 151c814f66..7eac273df6 100644 --- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md @@ -88,7 +88,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 Message ="*Get-ADUserResultantPasswordPolicy*" @@ -103,7 +103,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **get_aduserresultantpasswordpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **get_aduserresultantpasswordpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,6 +133,9 @@ Administrators or power users may use this command for troubleshooting. | 9.0 | 30 | 30 | powershell process having commandline $Message$ to query domain user password policy. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet) diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md index 26511d011a..cdf024c7a6 100644 --- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md @@ -89,7 +89,7 @@ This analytic looks for the execution of `powershell.exe` executing the `Get-Dom -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **get_domainpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **get_domainpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ Administrators or power users may use this command for troubleshooting. | 30.0 | 50 | 60 | an instance of process $process_name$ with commandline $process$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet) diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md index 926d4d8fa7..da99cc07c8 100644 --- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md @@ -88,7 +88,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 Message ="*Get-DomainPolicy*" @@ -103,7 +103,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **get_domainpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **get_domainpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,6 +133,9 @@ Administrators or power users may use this command for troubleshooting. | 30.0 | 50 | 60 | powershell process having commandline $Message$ to query domain policy. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet) diff --git a/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md b/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md index b415a9f33b..253b326e7e 100644 --- a/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md @@ -93,7 +93,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 (Message = "*Get-DomainGroup*") @@ -107,7 +107,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **getdomaingroup_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **getdomaingroup_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,6 +137,9 @@ Administrators or power users may use this PowerView functions for troubleshooti | 15.0 | 30 | 50 | Domain group discovery enumeration using PowerView on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/) diff --git a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md index 6b3ba28a4f..53025e09c9 100644 --- a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md +++ b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md @@ -89,7 +89,7 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command li -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **password_policy_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **password_policy_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ Administrators or power users may use this command for troubleshooting. | 9.0 | 30 | 30 | an instance of process $process_name$ with commandline $process$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet) diff --git a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md index c4a48fcdfa..7630a9e43e 100644 --- a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md +++ b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md @@ -101,7 +101,7 @@ This search looks for a process launching an `*.lnk` file under `C:\User*` or `* -#### Search +#### Search ``` @@ -124,7 +124,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **process_creating_lnk_file_in_suspicious_location_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **process_creating_lnk_file_in_suspicious_location_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -156,6 +157,9 @@ This detection should yield little or no false positive results. It is uncommon | 63.0 | 70 | 90 | A process $process_name$ that launching .lnk file in $file_path$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1566/001/](https://attack.mitre.org/techniques/T1566/001/) diff --git a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md index 8e842a6653..2d8c8c72d3 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md +++ b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md @@ -15,7 +15,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -94,7 +94,7 @@ Review the source attempting to perform this activity against your environment. -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [exchange](https://github.com/splunk/security_content/blob/develop/macros/exchange.yml) -Note that **exchange_powershell_abuse_via_ssrf_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **exchange_powershell_abuse_via_ssrf_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ Limited false positives, however, tune as needed. | 80.0 | 80 | 100 | Activity related to ProxyShell has been identified on $dest$. Review events and take action accordingly. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/GossiTheDog/ThreatHunting/blob/master/AzureSentinel/Exchange-Powershell-via-SSRF](https://github.com/GossiTheDog/ThreatHunting/blob/master/AzureSentinel/Exchange-Powershell-via-SSRF) diff --git a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md index 6a8b49ac48..c6df2cf778 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md +++ b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md @@ -18,7 +18,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -99,7 +99,7 @@ Module - New-managementroleassignment can assign a management role to a manageme -#### Search +#### Search ``` `powershell` EventCode=4104 Message IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*") @@ -114,7 +114,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **exchange_powershell_module_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **exchange_powershell_module_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo | 15.0 | 30 | 50 | Local user discovery enumeration using PowerShell on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps](https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps) diff --git a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md index 7e3e198738..5b5fec4020 100644 --- a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md +++ b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md @@ -89,7 +89,7 @@ This analytic looks for the execution of `nltest.exe` with command-line argument -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **domain_controller_discovery_with_nltest_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **domain_controller_discovery_with_nltest_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -140,6 +141,9 @@ Administrators or power users may use this command for troubleshooting. | 21.0 | 30 | 70 | Domain controller discovery on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md index daa87048a6..71ee65d8a8 100644 --- a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md +++ b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md @@ -89,7 +89,7 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **remote_system_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **remote_system_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -140,6 +141,9 @@ Administrators or power users may use this command for troubleshooting. | 15.0 | 30 | 50 | Remote system discovery enumeration on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md index e0563e1381..3404818a3e 100644 --- a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md +++ b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md @@ -96,7 +96,7 @@ During triage, review parallel security events to identify further suspicious ac -#### Search +#### Search ``` `wineventlog_security` Account_Name="ANONYMOUS LOGON" EventCode=5145 Relative_Target_Name=lsarpc @@ -108,10 +108,11 @@ During triage, review parallel security events to identify further suspicious ac #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **petitpotam_network_share_access_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **petitpotam_network_share_access_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ False positives have been limited when the Anonymous Logon is used for Account N | 56.0 | 80 | 70 | A remote host is enumerating a $dest$ to identify permissions. This is a precursor event to CVE-2021-36942, PetitPotam. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1187/](https://attack.mitre.org/techniques/T1187/) diff --git a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md index 7a201fa852..952eae11b7 100644 --- a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md +++ b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md @@ -93,7 +93,7 @@ The following analytic identifes Event Code 4768, A `Kerberos authentication tic -#### Search +#### Search ``` `wineventlog_security` EventCode=4768 Client_Address!="::1" Certificate_Thumbprint!="" Account_Name=*$ @@ -105,10 +105,11 @@ The following analytic identifes Event Code 4768, A `Kerberos authentication tic #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **petitpotam_suspicious_kerberos_tgt_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **petitpotam_suspicious_kerberos_tgt_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ False positives are possible if the environment is using certificates for authen | 56.0 | 80 | 70 | A Kerberos TGT was requested in a non-standard manner against $dest$, potentially related to CVE-2021-36942, PetitPotam. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4768](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4768) diff --git a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md index 57780bb983..d91097e2a6 100644 --- a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md +++ b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md @@ -89,7 +89,7 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **remote_system_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **remote_system_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -140,6 +141,9 @@ Administrators or power users may use this command for troubleshooting. | 15.0 | 30 | 50 | Remote system discovery enumeration on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-09-01-circle_ci_disable_security_step.md b/docs/_posts/2021-09-01-circle_ci_disable_security_step.md index 16f9fdc1a0..93b01d25c8 100644 --- a/docs/_posts/2021-09-01-circle_ci_disable_security_step.md +++ b/docs/_posts/2021-09-01-circle_ci_disable_security_step.md @@ -94,7 +94,7 @@ This search looks for disable security step in CircleCI pipeline. -#### Search +#### Search ``` `circleci` @@ -117,10 +117,11 @@ This search looks for disable security step in CircleCI pipeline. #### Macros The SPL above uses the following Macros: -* [circleci](https://github.com/splunk/security_content/blob/develop/macros/circleci.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [circleci](https://github.com/splunk/security_content/blob/develop/macros/circleci.yml) -Note that **circle_ci_disable_security_step_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **circle_ci_disable_security_step_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -150,6 +151,9 @@ unknown | 72.0 | 80 | 90 | disable security step $mandatory_step$ in job $job_name$ from user $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md index 51f1e6804f..9b9ad568fc 100644 --- a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md +++ b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md @@ -89,7 +89,7 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **domain_controller_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **domain_controller_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -140,6 +141,9 @@ Administrators or power users may use this command for troubleshooting. | 21.0 | 30 | 70 | Domain controller discovery on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md index 7458b60319..116d42da37 100644 --- a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md +++ b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md @@ -94,7 +94,7 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **domain_group_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **domain_group_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -145,6 +146,9 @@ Administrators or power users may use this command for troubleshooting. | 15.0 | 30 | 50 | Domain group discovery enumeration on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/) diff --git a/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md index ca74bdfbd3..7509d69ecc 100644 --- a/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md @@ -88,7 +88,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 (Message = "*Get-AdComputer*") @@ -102,7 +102,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **getadcomputer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **getadcomputer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,6 +132,9 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo | 15.0 | 30 | 50 | Remote system discovery enumeration on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md index 251013dd50..0c33804148 100644 --- a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md @@ -88,7 +88,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace root\\directory\\ldap*" AND Message="*class ds_computer*") @@ -102,7 +102,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **getwmiobject_ds_computer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **getwmiobject_ds_computer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,6 +132,9 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo | 15.0 | 30 | 50 | Remote system discovery enumeration on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-09-01-github_commit_in_develop.md b/docs/_posts/2021-09-01-github_commit_in_develop.md index 0abc9367f5..90b7ec16d5 100644 --- a/docs/_posts/2021-09-01-github_commit_in_develop.md +++ b/docs/_posts/2021-09-01-github_commit_in_develop.md @@ -88,7 +88,7 @@ This search is to detect a pushed or commit to develop branch. This is to avoid -#### Search +#### Search ``` `github` branches{}.name = main OR branches{}.name = develop @@ -104,7 +104,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) -Note that **github_commit_in_develop_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **github_commit_in_develop_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -129,6 +130,9 @@ admin can do changes directly to develop branch | 9.0 | 30 | 30 | suspicious commit by $commit.commit.author.email$ to develop branch | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.redhat.com/en/topics/devops/what-is-devsecops](https://www.redhat.com/en/topics/devops/what-is-devsecops) diff --git a/docs/_posts/2021-09-01-github_dependabot_alert.md b/docs/_posts/2021-09-01-github_dependabot_alert.md index e11fd95fd7..ef6c0a97c2 100644 --- a/docs/_posts/2021-09-01-github_dependabot_alert.md +++ b/docs/_posts/2021-09-01-github_dependabot_alert.md @@ -99,7 +99,7 @@ This search looks for Dependabot Alerts in Github logs. -#### Search +#### Search ``` `github` alert.id=* action=create @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) -Note that **github_dependabot_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **github_dependabot_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,6 +153,9 @@ unknown | 27.0 | 30 | 90 | Vulnerabilities found in packages used by GitHub repository $repository$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html](https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html) diff --git a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md index 9d11c699b6..a81f49a45b 100644 --- a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md +++ b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md @@ -99,7 +99,7 @@ This search looks for Pull Request from unknown user. -#### Search +#### Search ``` `github` check_suite.pull_requests{}.id=* @@ -114,11 +114,12 @@ This search looks for Pull Request from unknown user. #### Macros The SPL above uses the following Macros: -* [github_known_users](https://github.com/splunk/security_content/blob/develop/macros/github_known_users.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) +* [github_known_users](https://github.com/splunk/security_content/blob/develop/macros/github_known_users.yml) -Note that **github_pull_request_from_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **github_pull_request_from_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -154,6 +155,9 @@ unknown | 27.0 | 30 | 90 | Vulnerabilities found in packages used by GitHub repository $repository$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html](https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html) diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md b/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md index dc5ff56748..49786f72ab 100644 --- a/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md +++ b/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md @@ -88,7 +88,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 (Message = "*[adsisearcher]*" AND Message = "*objectclass=computer*" AND Message = "*findAll()*") @@ -102,7 +102,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **remote_system_discovery_with_adsisearcher_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **remote_system_discovery_with_adsisearcher_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,6 +132,9 @@ Administrators or power users may use Adsisearcher for troubleshooting. | 15.0 | 30 | 50 | Remote system discovery enumeration on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md index 41ba7fb86a..2cfdf7f113 100644 --- a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md +++ b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md @@ -89,7 +89,7 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **remote_system_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **remote_system_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -140,6 +141,9 @@ Administrators or power users may use this command for troubleshooting. | 15.0 | 30 | 50 | Remote system discovery enumeration on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-09-02-circle_ci_disable_security_job.md b/docs/_posts/2021-09-02-circle_ci_disable_security_job.md index 0594577878..067c7bf271 100644 --- a/docs/_posts/2021-09-02-circle_ci_disable_security_job.md +++ b/docs/_posts/2021-09-02-circle_ci_disable_security_job.md @@ -94,7 +94,7 @@ This search looks for disable security job in CircleCI pipeline. -#### Search +#### Search ``` `circleci` @@ -113,10 +113,11 @@ This search looks for disable security job in CircleCI pipeline. #### Macros The SPL above uses the following Macros: -* [circleci](https://github.com/splunk/security_content/blob/develop/macros/circleci.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [circleci](https://github.com/splunk/security_content/blob/develop/macros/circleci.yml) -Note that **circle_ci_disable_security_job_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **circle_ci_disable_security_job_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -146,6 +147,9 @@ unknown | 72.0 | 80 | 90 | disable security job $mandatory_job$ in workflow $workflow_name$ from user $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md index e9def069d3..b146442398 100644 --- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md +++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md @@ -89,7 +89,7 @@ This analytic identifies Get-ForestTrust from PowerSploit in order to gather dom -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **get-foresttrust_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **get-foresttrust_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ Limited false positives as this requires an active Administrator or adversary to | 12.0 | 30 | 40 | Suspicious PowerShell Get-ForestTrust was identified on endpoint $dest$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/](https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/) diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md index ffb7941b13..ecfdb52b71 100644 --- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md @@ -90,7 +90,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It -#### Search +#### Search ``` `powershell` EventCode=4104 ScriptBlockText = "*get-foresttrust*" @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **get-foresttrust_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **get-foresttrust_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,6 +137,9 @@ False positives may be present. Tune as needed. | 12.0 | 30 | 40 | Suspicious PowerShell Get-ForestTrust was identified on endpoint $ComputerName$ by user $User$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/](https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/) diff --git a/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md b/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md index 2c9fca5e37..a213227ba0 100644 --- a/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md @@ -88,7 +88,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 (Message = "*Get-DomainComputer*") @@ -102,7 +102,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **getdomaincomputer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **getdomaincomputer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,6 +132,9 @@ Administrators or power users may use PowerView for troubleshooting. | 24.0 | 30 | 80 | Remote system discovery with PowerView on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md b/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md index 60d9ddb12d..dcd3098cfb 100644 --- a/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md @@ -88,7 +88,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 (Message = "*Get-DomainController*") @@ -102,7 +102,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **getdomaincontroller_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **getdomaincontroller_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,6 +132,9 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo | 24.0 | 30 | 80 | Remote system discovery with PowerView on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md index 0031d212c1..e61e6e5eb5 100644 --- a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md +++ b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md @@ -89,7 +89,7 @@ This search is to detect a suspicious bcdedit commandline to configure the host -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **bcdedit_command_back_to_normal_mode_boot_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **bcdedit_command_back_to_normal_mode_boot_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,6 +137,9 @@ unknown | 35.0 | 50 | 70 | bcdedit process with commandline $process$ to bring back to normal boot configuration the $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/](https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/) diff --git a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md index a9936b2e55..7ab1cfc5c2 100644 --- a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md +++ b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md @@ -89,7 +89,7 @@ This search is to detect a suspicious bcdedit commandline to configure the host -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **change_to_safe_mode_with_network_config_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **change_to_safe_mode_with_network_config_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,6 +137,9 @@ unknown | 25.0 | 50 | 50 | bcdedit process with commandline $process$ to force safemode boot the $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/](https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/) diff --git a/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md b/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md index 00deb4123c..14a1b75ef4 100644 --- a/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md +++ b/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md @@ -99,7 +99,7 @@ This search correlations detections by repository and risk_score -#### Search +#### Search ``` `signals` @@ -114,7 +114,8 @@ This search correlations detections by repository and risk_score The SPL above uses the following Macros: * [signals](https://github.com/splunk/security_content/blob/develop/macros/signals.yml) -Note that **correlation_by_repository_and_risk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **correlation_by_repository_and_risk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ unknown | 70.0 | 70 | 100 | Correlation triggered for user $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-09-06-correlation_by_user_and_risk.md b/docs/_posts/2021-09-06-correlation_by_user_and_risk.md index 485c22af9b..b7adb3f7aa 100644 --- a/docs/_posts/2021-09-06-correlation_by_user_and_risk.md +++ b/docs/_posts/2021-09-06-correlation_by_user_and_risk.md @@ -99,7 +99,7 @@ This search correlations detections by user and risk_score -#### Search +#### Search ``` `signals` @@ -114,7 +114,8 @@ This search correlations detections by user and risk_score The SPL above uses the following Macros: * [signals](https://github.com/splunk/security_content/blob/develop/macros/signals.yml) -Note that **correlation_by_user_and_risk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **correlation_by_user_and_risk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ unknown | 70.0 | 70 | 100 | Correlation triggered for user $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md index a20a9c9313..621cc8f160 100644 --- a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md +++ b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md @@ -89,7 +89,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **getadcomputer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **getadcomputer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -140,6 +141,9 @@ Administrators or power users may use this command for troubleshooting. | 15.0 | 30 | 50 | Remote system discovery enumeration on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md index 15740abd49..6a94a8d6cb 100644 --- a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md +++ b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md @@ -89,7 +89,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **getdomaincomputer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **getdomaincomputer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -140,6 +141,9 @@ Administrators or power users may use PowerView for troubleshooting. | 24.0 | 30 | 80 | Remote system discovery enumeration on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md index 4f0ea808a1..952e9e8c86 100644 --- a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md +++ b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md @@ -89,7 +89,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **getdomaincontroller_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **getdomaincontroller_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -140,6 +141,9 @@ Administrators or power users may use PowerView for troubleshooting. | 24.0 | 30 | 80 | Remote system discovery using PowerView on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md index a9103a3279..537f1f127e 100644 --- a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md +++ b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md @@ -89,7 +89,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **getwmiobject_ds_computer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **getwmiobject_ds_computer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -140,6 +141,9 @@ Administrators or power users may use this command for troubleshooting. | 21.0 | 30 | 70 | Remote system discovery enumeration using WMI on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md index 1eaa3883ce..200fd6b378 100644 --- a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md +++ b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md @@ -94,7 +94,7 @@ This analytic is to detect an application try to connect and create ADSI Object -#### Search +#### Search ``` `sysmon` EventCode=11 TargetFilename = "*\\Windows\\SchCache\\*" TargetFilename = "*.sch*" NOT (Image IN ("*\\Windows\\system32\\mmc.exe")) @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **schcache_change_by_app_connect_and_create_adsi_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **schcache_change_by_app_connect_and_create_adsi_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +141,9 @@ normal application like mmc.exe and other ldap query tool may trigger this detec | 25.0 | 50 | 50 | process $Image$ create a file $TargetFilename$ in host $Computer$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.microsoft.com/en-us/windows/win32/adsi/adsi-and-uac](https://docs.microsoft.com/en-us/windows/win32/adsi/adsi-and-uac) diff --git a/docs/_posts/2021-09-07-system_information_discovery_detection.md b/docs/_posts/2021-09-07-system_information_discovery_detection.md index fa3e0638d3..24fc781d70 100644 --- a/docs/_posts/2021-09-07-system_information_discovery_detection.md +++ b/docs/_posts/2021-09-07-system_information_discovery_detection.md @@ -94,7 +94,7 @@ Detect system information discovery techniques used by attackers to understand c -#### Search +#### Search ``` @@ -113,7 +113,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **system_information_discovery_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **system_information_discovery_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ Administrators debugging servers | 15.0 | 30 | 50 | Potential system information discovery behavior on $dest$ by $User$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://oscp.infosecsanyam.in/priv-escalation/windows-priv-escalation](https://oscp.infosecsanyam.in/priv-escalation/windows-priv-escalation) diff --git a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md index ac5f43b0d6..c251ac64b1 100644 --- a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md +++ b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md @@ -1,6 +1,6 @@ --- title: "Control Loading from World Writable Directory" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Control Panel " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-09-08 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Control Panel - Defense Evasion - Defense Evasion @@ -46,7 +46,7 @@ The following detection identifies control.exe loading either a .cpl or .inf fro | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.002](https://attack.mitre.org/techniques/T1218/002/) | Control Panel | Defense Evasion | @@ -99,7 +99,7 @@ The following detection identifies control.exe loading either a .cpl or .inf fro -#### Search +#### Search ``` @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **control_loading_from_world_writable_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **control_loading_from_world_writable_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -151,6 +152,9 @@ Limited false positives will be present as control.exe does not natively load fr | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html](https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html) diff --git a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md index 4ebe764bbd..2c4d2ec4df 100644 --- a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md +++ b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md @@ -99,7 +99,7 @@ This search looks for the creation of local administrator accounts using net.exe -#### Search +#### Search ``` @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **create_local_admin_accounts_using_net_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **create_local_admin_accounts_using_net_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ Administrators often leverage net.exe to create admin accounts. | 30.0 | 50 | 60 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators group. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-09-08-office_spawning_control.md b/docs/_posts/2021-09-08-office_spawning_control.md index 691988e6d3..9a8b99ba29 100644 --- a/docs/_posts/2021-09-08-office_spawning_control.md +++ b/docs/_posts/2021-09-08-office_spawning_control.md @@ -99,7 +99,7 @@ The following detection identifies control.exe spawning from an office product. -#### Search +#### Search ``` @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **office_spawning_control_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **office_spawning_control_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -151,6 +152,9 @@ Limited false positives should be present. | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ clicking a suspicious attachment. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://strontic.github.io/xcyclopedia/library/control.exe-1F13E714A0FEA8887707DFF49287996F.html](https://strontic.github.io/xcyclopedia/library/control.exe-1F13E714A0FEA8887707DFF49287996F.html) diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md index 3915468256..b6e0e42549 100644 --- a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md +++ b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md @@ -1,6 +1,6 @@ --- title: "Rundll32 Control RunDLL Hunt" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Rundll32 " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-09-08 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Rundll32 - Defense Evasion - Defense Evasion @@ -46,7 +46,7 @@ The following hunting detection identifies rundll32.exe with `control_rundll` wi | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | @@ -99,7 +99,7 @@ The following hunting detection identifies rundll32.exe with `control_rundll` wi -#### Search +#### Search ``` @@ -112,11 +112,12 @@ The following hunting detection identifies rundll32.exe with `control_rundll` wi #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -Note that **rundll32_control_rundll_hunt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **rundll32_control_rundll_hunt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -153,6 +154,9 @@ This is a hunting detection, meant to provide a understanding of how voluminous | 15.0 | 30 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html](https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html) diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md index 9bfd43541e..f4b7ec665a 100644 --- a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md +++ b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md @@ -1,6 +1,6 @@ --- title: "Rundll32 Control RunDLL World Writable Directory" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Rundll32 " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-09-08 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Rundll32 - Defense Evasion - Defense Evasion @@ -46,7 +46,7 @@ The following detection identifies rundll32.exe with `control_rundll` within the | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | @@ -99,7 +99,7 @@ The following detection identifies rundll32.exe with `control_rundll` within the -#### Search +#### Search ``` @@ -112,11 +112,12 @@ The following detection identifies rundll32.exe with `control_rundll` within the #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -Note that **rundll32_control_rundll_world_writable_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **rundll32_control_rundll_world_writable_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -153,6 +154,9 @@ This may be tuned, or a new one related, by adding .cpl to command-line. However | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html](https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html) diff --git a/docs/_posts/2021-09-09-extraction_of_registry_hives.md b/docs/_posts/2021-09-09-extraction_of_registry_hives.md index a529f038f5..22abd57cc3 100644 --- a/docs/_posts/2021-09-09-extraction_of_registry_hives.md +++ b/docs/_posts/2021-09-09-extraction_of_registry_hives.md @@ -94,7 +94,7 @@ The following analytic identifies the use of `reg.exe` exporting Windows Registr -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) -Note that **extraction_of_registry_hives_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **extraction_of_registry_hives_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,6 +149,9 @@ It is possible some agent based products will generate false positives. Filter a | 56.0 | 80 | 70 | Suspicious use of `reg.exe` exporting Windows Registry hives containing credentials executed on $dest$ by user $user$, with a parent process of $parent_process_id$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html](https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html) diff --git a/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md b/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md index ef5d4bfdea..2a16daca8c 100644 --- a/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md +++ b/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md @@ -99,7 +99,7 @@ The following detection identifies the module load of mshtml.dll into an Office -#### Search +#### Search ``` `sysmon` EventID=7 process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **mshtml_module_load_in_office_product_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **mshtml_module_load_in_office_product_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ Limited false positives will be present, however, tune as necessary. | 80.0 | 80 | 100 | An instance of $process_name$ was identified on endpoint $dest$ loading mshtml.dll. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/](https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/) diff --git a/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md b/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md index bf3910700c..c4e393c123 100644 --- a/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md +++ b/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md @@ -88,7 +88,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 (Message = "*Get-NetTcpconnection*") @@ -102,7 +102,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **getnettcpconnection_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **getnettcpconnection_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,6 +132,9 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo | 15.0 | 30 | 50 | Network Connection discovery on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1049/](https://attack.mitre.org/techniques/T1049/) diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md index af9a68ef5d..e83cd8566e 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md @@ -89,7 +89,7 @@ This analytic looks for the execution of `arp.exe` utilized to get a listing of -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **network_connection_discovery_with_arp_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **network_connection_discovery_with_arp_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -140,6 +141,9 @@ Administrators or power users may use this command for troubleshooting. | 15.0 | 30 | 50 | Network Connection discovery on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1049/](https://attack.mitre.org/techniques/T1049/) diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md index 0168faaa63..0dfd1f7aef 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md @@ -89,7 +89,7 @@ This analytic looks for the execution of `net.exe` with command-line arguments u -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **network_connection_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **network_connection_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -140,6 +141,9 @@ Administrators or power users may use this command for troubleshooting. | 15.0 | 30 | 50 | Network Connection discovery on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1049/](https://attack.mitre.org/techniques/T1049/) diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md index 918909996a..d7b499849c 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md @@ -89,7 +89,7 @@ This analytic looks for the execution of `netstat.exe` with command-line argumen -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **network_connection_discovery_with_netstat_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **network_connection_discovery_with_netstat_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -140,6 +141,9 @@ Administrators or power users may use this command for troubleshooting. | 15.0 | 30 | 50 | Network Connection discovery on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1049/](https://attack.mitre.org/techniques/T1049/) diff --git a/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md b/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md index d1353cef0a..146ce8c0c3 100644 --- a/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md +++ b/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md @@ -99,7 +99,7 @@ The following analytic identifies behavior related to CVE-2021-40444. Whereas th -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The following analytic identifies behavior related to CVE-2021-40444. Whereas th The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **office_product_writing_cab_or_inf_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **office_product_writing_cab_or_inf_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,6 +151,9 @@ The query is structured in a way that `action` (read, create) is not defined. Re | 80.0 | 80 | 100 | An instance of $process_name$ was identified on $dest$ writing an inf or cab file to this. This is not typical of $process_name$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://twitter.com/vxunderground/status/1436326057179860992?s=20](https://twitter.com/vxunderground/status/1436326057179860992?s=20) diff --git a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md index 25ff61b535..4427baae72 100644 --- a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md +++ b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md @@ -89,7 +89,7 @@ This analytic looks for the execution of `powerhsell.exe` with command-line argu -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **getcurrent_user_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **getcurrent_user_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ Administrators or power users may use this command for troubleshooting. | 15.0 | 30 | 50 | System user discovery on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1033/](https://attack.mitre.org/techniques/T1033/) diff --git a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md index ba077ce248..a8d7d0fbe8 100644 --- a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md +++ b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md @@ -94,7 +94,7 @@ This search is to detect a execution of jscript using cscript process. Commonly -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **jscript_execution_using_cscript_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **jscript_execution_using_cscript_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ unknown | 49.0 | 70 | 70 | Process name $process_name$ with commandline $process$ to execute jscript in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html](https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html) diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md index b22db9bfd2..d99bf67cc0 100644 --- a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md +++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md @@ -94,7 +94,7 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o -#### Search +#### Search ``` `sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\Wldap32.dll", "*\\adsldp.dll", "*\\adsldpc.dll") @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **ms_scripting_process_loading_ldap_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **ms_scripting_process_loading_ldap_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ automation scripting language may used by network operator to do ldap query. | 9.0 | 30 | 30 | $process_name$ loading ldap modules $ImageLoaded$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html](https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html) diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md index 0addc06e17..101685c5f7 100644 --- a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md +++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md @@ -94,7 +94,7 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o -#### Search +#### Search ``` `sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded IN ("*\\fastprox.dll", "*\\wbemdisp.dll", "*\\wbemprox.dll", "*\\wbemsvc.dll" , "*\\wmiutils.dll", "*\\wbemcomn.dll") @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **ms_scripting_process_loading_wmi_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **ms_scripting_process_loading_wmi_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ automation scripting language may used by network operator to do ldap query. | 9.0 | 30 | 30 | $process_name$ loading wmi modules $ImageLoaded$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html](https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html) diff --git a/docs/_posts/2021-09-13-office_application_drop_executable.md b/docs/_posts/2021-09-13-office_application_drop_executable.md index 1df8b93a59..4b6ace04ab 100644 --- a/docs/_posts/2021-09-13-office_application_drop_executable.md +++ b/docs/_posts/2021-09-13-office_application_drop_executable.md @@ -94,7 +94,7 @@ This search is to detect a suspicious MS office application that drop or create -#### Search +#### Search ``` @@ -115,7 +115,8 @@ This search is to detect a suspicious MS office application that drop or create The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **office_application_drop_executable_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **office_application_drop_executable_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ office macro for automation may do this behavior | 64.0 | 80 | 80 | process $process_name$ drops a file $TargetFilename$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html](https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html) diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_query.md b/docs/_posts/2021-09-13-system_user_discovery_with_query.md index ef4ea6393a..52d1d9bbf0 100644 --- a/docs/_posts/2021-09-13-system_user_discovery_with_query.md +++ b/docs/_posts/2021-09-13-system_user_discovery_with_query.md @@ -89,7 +89,7 @@ This analytic looks for the execution of `query.exe` with command-line arguments -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **system_user_discovery_with_query_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **system_user_discovery_with_query_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ Administrators or power users may use this command for troubleshooting. | 15.0 | 30 | 50 | System user discovery on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1033/](https://attack.mitre.org/techniques/T1033/) diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md index f39d546e62..416f13a02d 100644 --- a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md +++ b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md @@ -89,7 +89,7 @@ This analytic looks for the execution of `whoami.exe` without any arguments. Thi -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **system_user_discovery_with_whoami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **system_user_discovery_with_whoami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ Administrators or power users may use this command for troubleshooting. | 15.0 | 30 | 50 | System user discovery on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1033/](https://attack.mitre.org/techniques/T1033/) diff --git a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md index aa432dd2b5..d2f95d0594 100644 --- a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md +++ b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md @@ -89,7 +89,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **user_discovery_with_env_vars_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **user_discovery_with_env_vars_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ Administrators or power users may use this command for troubleshooting. | 15.0 | 30 | 50 | System user discovery on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1033/](https://attack.mitre.org/techniques/T1033/) diff --git a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md index a975ad8581..157935ec84 100644 --- a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md +++ b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md @@ -89,7 +89,7 @@ This search is to detect a suspicious wmic.exe process or renamed wmic process t -#### Search +#### Search ``` @@ -106,7 +106,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **xsl_script_execution_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **xsl_script_execution_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ unknown | 49.0 | 70 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing wmic to load a XSL script. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html](https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html) diff --git a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md index 1b78f08860..aa3d6cc99c 100644 --- a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md +++ b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md @@ -94,7 +94,7 @@ The following analytic identifies a non-standard parent process (not matching CM -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **cmdline_tool_not_executed_in_cmd_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **cmdline_tool_not_executed_in_cmd_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ A network operator or systems administrator may utilize an automated host discov | 56.0 | 70 | 80 | A non-standard parent process $parent_process_name$ spawned child process $process_name$ to execute command-line tool on $dest$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html](https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html) diff --git a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md index 7ab386ddde..1f2b2ba75d 100644 --- a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md +++ b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md @@ -94,7 +94,7 @@ The following hunting analytic identifies the use of `Get-WMIObject Win32_Group` -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **get_wmiobject_group_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **get_wmiobject_group_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ False positives may be present. Tune as needed. | 15.0 | 30 | 50 | System group discovery on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1069/001/](https://attack.mitre.org/techniques/T1069/001/) diff --git a/docs/_posts/2021-09-14-net_localgroup_discovery.md b/docs/_posts/2021-09-14-net_localgroup_discovery.md index e0dc3c0313..98acc74924 100644 --- a/docs/_posts/2021-09-14-net_localgroup_discovery.md +++ b/docs/_posts/2021-09-14-net_localgroup_discovery.md @@ -94,7 +94,7 @@ The following hunting analytic will identify the use of localgroup discovery usi -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **net_localgroup_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **net_localgroup_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ False positives may be present. Tune as needed. | 15.0 | 30 | 50 | Local group discovery on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1069/001/](https://attack.mitre.org/techniques/T1069/001/) diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md index 919212f1cc..3f8a0e3b86 100644 --- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md +++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md @@ -94,7 +94,7 @@ The following hunting analytic identifies the use of `get-localgroup` being used -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **powershell_get_localgroup_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **powershell_get_localgroup_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ False positives may be present. Tune as needed. | 15.0 | 30 | 50 | Local group discovery on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1069/001/](https://attack.mitre.org/techniques/T1069/001/) diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md index 69801f16d6..8a1f66a49e 100644 --- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md +++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md @@ -95,7 +95,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It -#### Search +#### Search ``` `powershell` EventCode=4104 Message = "*get-localgroup*" @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **powershell_get_localgroup_discovery_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **powershell_get_localgroup_discovery_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ False positives may be present. Tune as needed. | 15.0 | 30 | 50 | Local group discovery on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.splunk.com/en_us/blog/security/powershell-detections-threat-research-release-august-2021.html](https://www.splunk.com/en_us/blog/security/powershell-detections-threat-research-release-august-2021.html) diff --git a/docs/_posts/2021-09-14-wmic_group_discovery.md b/docs/_posts/2021-09-14-wmic_group_discovery.md index 08fc990e26..82c7650aeb 100644 --- a/docs/_posts/2021-09-14-wmic_group_discovery.md +++ b/docs/_posts/2021-09-14-wmic_group_discovery.md @@ -96,7 +96,7 @@ During triage, review parallel processes and identify any further suspicious beh -#### Search +#### Search ``` @@ -112,7 +112,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **wmic_group_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **wmic_group_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,6 +149,9 @@ Administrators or power users may use this command for troubleshooting. | 15.0 | 30 | 50 | Local group discovery on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1069/001/](https://attack.mitre.org/techniques/T1069/001/) diff --git a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md index 5b608d23f2..bcf8148dee 100644 --- a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md +++ b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md @@ -89,7 +89,7 @@ This search is to detect a suspicious whoami execution to check if the cmd or sh -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **check_elevated_cmd_using_whoami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **check_elevated_cmd_using_whoami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ unknown | 56.0 | 70 | 80 | Process name $process_name$ with commandline $process$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md index a8512fe65a..29bdd7ab70 100644 --- a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md +++ b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md @@ -94,7 +94,7 @@ This search is to detect an anomaly event of non-chrome process accessing the fi -#### Search +#### Search ``` `wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\chrome.exe", "*\\explorer.exe", "*sql*")) Object_Name="*\\Google\\Chrome\\User Data\\Default*" @@ -106,10 +106,11 @@ This search is to detect an anomaly event of non-chrome process accessing the fi #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **non_chrome_process_accessing_chrome_default_dir_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **non_chrome_process_accessing_chrome_default_dir_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ other browser not listed related to firefox may catch by this rule. | 35.0 | 50 | 70 | a non firefox browser process $process_name$ accessing $Object_Name$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md index 7d77ef65e4..3c40aaaf61 100644 --- a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md +++ b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md @@ -94,7 +94,7 @@ This search is to detect an anomaly event of non-firefox process accessing the f -#### Search +#### Search ``` `wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\firefox.exe", "*\\explorer.exe", "*sql*")) Object_Name="*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles*" @@ -106,10 +106,11 @@ This search is to detect an anomaly event of non-firefox process accessing the f #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **non_firefox_process_access_firefox_profile_dir_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **non_firefox_process_access_firefox_profile_dir_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ other browser not listed related to firefox may catch by this rule. | 35.0 | 50 | 70 | a non firefox browser process $process_name$ accessing $Object_Name$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-09-16-account_discovery_with_net_app.md b/docs/_posts/2021-09-16-account_discovery_with_net_app.md index bf6217f553..730ab62d84 100644 --- a/docs/_posts/2021-09-16-account_discovery_with_net_app.md +++ b/docs/_posts/2021-09-16-account_discovery_with_net_app.md @@ -94,7 +94,7 @@ this search is to detect a potential account discovery series of command used by -#### Search +#### Search ``` @@ -109,10 +109,11 @@ this search is to detect a potential account discovery series of command used by #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -Note that **account_discovery_with_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **account_discovery_with_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ admin or power user may used this series of command. | 5.0 | 10 | 50 | Suspicious $process_name$ usage detected on endpoint $dest$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://labs.vipre.com/trickbot-and-its-modules/](https://labs.vipre.com/trickbot-and-its-modules/) diff --git a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md index 11ea822816..634afec4b1 100644 --- a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md +++ b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md @@ -103,7 +103,7 @@ Attempt To Add Certificate To Untrusted Store -#### Search +#### Search ``` @@ -120,7 +120,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **attempt_to_add_certificate_to_untrusted_store_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **attempt_to_add_certificate_to_untrusted_store_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ There may be legitimate reasons for administrators to add a certificate to the u | 35.0 | 70 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified attempting to add a certificate to the store on endpoint $dest$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md) diff --git a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md index 314fed6aab..0ce7794c62 100644 --- a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md +++ b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md @@ -100,7 +100,7 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th -#### Search +#### Search ``` @@ -113,12 +113,13 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) -Note that **attempted_credential_dump_from_registry_via_reg_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **attempted_credential_dump_from_registry_via_reg_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -157,6 +158,9 @@ None identified. | 90.0 | 90 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets) diff --git a/docs/_posts/2021-09-16-batch_file_write_to_system32.md b/docs/_posts/2021-09-16-batch_file_write_to_system32.md index 7573c5f585..4539e6212c 100644 --- a/docs/_posts/2021-09-16-batch_file_write_to_system32.md +++ b/docs/_posts/2021-09-16-batch_file_write_to_system32.md @@ -99,7 +99,7 @@ The search looks for a batch file (.bat) written to the Windows system directory -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The search looks for a batch file (.bat) written to the Windows system directory The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **batch_file_write_to_system32_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **batch_file_write_to_system32_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,6 +151,9 @@ It is possible for this search to generate a notable event for a batch file writ | 63.0 | 70 | 90 | A file - $file_name$ was written to system32 has occurred on endpoint $dest$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-09-16-bits_job_persistence.md b/docs/_posts/2021-09-16-bits_job_persistence.md index 92c79f5ee8..7d7cb5605e 100644 --- a/docs/_posts/2021-09-16-bits_job_persistence.md +++ b/docs/_posts/2021-09-16-bits_job_persistence.md @@ -90,7 +90,7 @@ The following query identifies Microsoft Background Intelligent Transfer Service -#### Search +#### Search ``` @@ -103,11 +103,12 @@ The following query identifies Microsoft Background Intelligent Transfer Service #### Macros The SPL above uses the following Macros: -* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) -Note that **bits_job_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **bits_job_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ Limited false positives will be present. Typically, applications will use `BitsA | 56.0 | 70 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to persist using BITS. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1197/](https://attack.mitre.org/techniques/T1197/) diff --git a/docs/_posts/2021-09-16-bitsadmin_download_file.md b/docs/_posts/2021-09-16-bitsadmin_download_file.md index 5aa5f000bb..9886644f77 100644 --- a/docs/_posts/2021-09-16-bitsadmin_download_file.md +++ b/docs/_posts/2021-09-16-bitsadmin_download_file.md @@ -95,7 +95,7 @@ The following query identifies Microsoft Background Intelligent Transfer Service -#### Search +#### Search ``` @@ -108,11 +108,12 @@ The following query identifies Microsoft Background Intelligent Transfer Service #### Macros The SPL above uses the following Macros: -* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) -Note that **bitsadmin_download_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **bitsadmin_download_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ Limited false positives, however it may be required to filter based on parent pr | 49.0 | 70 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download](https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download) diff --git a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md index e50422d9a6..b771571417 100644 --- a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md +++ b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md @@ -99,7 +99,7 @@ This search detects the use of wmic and Powershell to create a shadow copy. -#### Search +#### Search ``` @@ -117,7 +117,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -Note that **creation_of_shadow_copy_with_wmic_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **creation_of_shadow_copy_with_wmic_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -154,6 +155,9 @@ Legtimate administrator usage of wmic to create a shadow copy. | 81.0 | 90 | 90 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf](https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf) diff --git a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md index 1db60a2216..92974311a8 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md @@ -99,7 +99,7 @@ This search detects credential dumping using copy command from a shadow copy. -#### Search +#### Search ``` @@ -112,11 +112,12 @@ This search detects credential dumping using copy command from a shadow copy. #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -Note that **credential_dumping_via_copy_command_from_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **credential_dumping_via_copy_command_from_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,6 +153,9 @@ unknown | 81.0 | 90 | 90 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to copy SAM and NTDS.dit for offline password cracking. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf](https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf) diff --git a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md index b580f5a1bf..580f8d08a6 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md @@ -99,7 +99,7 @@ This search detects the creation of a symlink to a shadow copy. -#### Search +#### Search ``` @@ -112,11 +112,12 @@ This search detects the creation of a symlink to a shadow copy. #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -Note that **credential_dumping_via_symlink_to_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **credential_dumping_via_symlink_to_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,6 +153,9 @@ unknown | 81.0 | 90 | 90 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create symlink to a shadow copy to grab credentials. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf](https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf) diff --git a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md index 669863689f..f8be9cf371 100644 --- a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md @@ -1,6 +1,6 @@ --- title: "Detect HTML Help URL in Command Line" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Compiled HTML File " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-09-16 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Compiled HTML File - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.001](https://attack.mitre.org/techniques/T1218/001/) | Compiled HTML File | Defense Evasion | @@ -99,7 +99,7 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM -#### Search +#### Search ``` @@ -113,10 +113,11 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_html_help_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_html_help_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ Although unlikely, some legitimate applications may retrieve a CHM remotely, fil | 90.0 | 90 | 100 | An instance of $parent_proces_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ contacting a remote destination to potentally download a malicious payload. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1218/001/](https://attack.mitre.org/techniques/T1218/001/) diff --git a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md index 155da4c476..db81e9d010 100644 --- a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md +++ b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md @@ -1,6 +1,6 @@ --- title: "Detect HTML Help Using InfoTech Storage Handlers" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Compiled HTML File " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-09-16 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Compiled HTML File - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.001](https://attack.mitre.org/techniques/T1218/001/) | Compiled HTML File | Defense Evasion | @@ -99,7 +99,7 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM -#### Search +#### Search ``` @@ -113,10 +113,11 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_html_help_using_infotech_storage_handlers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_html_help_using_infotech_storage_handlers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ It is rare to see instances of InfoTech Storage Handlers being used, but it does | 72.0 | 80 | 90 | $process_name$ has been identified using Infotech Storage Handlers to load a specific file within a CHM on $dest$ under user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1218/001/](https://attack.mitre.org/techniques/T1218/001/) diff --git a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md index 87bdbc14f7..646ceb31a7 100644 --- a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md +++ b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md @@ -1,6 +1,6 @@ --- title: "Detect mshta inline hta execution" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Mshta " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-09-16 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Mshta - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ The following analytic identifies "mshta.exe" execution with inline protocol han | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | @@ -99,7 +99,7 @@ The following analytic identifies "mshta.exe" execution with inline protocol han -#### Search +#### Search ``` @@ -112,11 +112,12 @@ The following analytic identifies "mshta.exe" execution with inline protocol han #### Macros The SPL above uses the following Macros: -* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) -Note that **detect_mshta_inline_hta_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_mshta_inline_hta_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg | 90.0 | 90 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing with inline HTA, indicative of defense evasion. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/AtomicTestHarnesses](https://github.com/redcanaryco/AtomicTestHarnesses) diff --git a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md index 636fe811c1..2c475a64e0 100644 --- a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md @@ -1,6 +1,6 @@ --- title: "Detect MSHTA Url in Command Line" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Mshta " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-09-16 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Mshta - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ This analytic identifies when Microsoft HTML Application Host (mshta.exe) utilit | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | @@ -99,7 +99,7 @@ This analytic identifies when Microsoft HTML Application Host (mshta.exe) utilit -#### Search +#### Search ``` @@ -112,11 +112,12 @@ This analytic identifies when Microsoft HTML Application Host (mshta.exe) utilit #### Macros The SPL above uses the following Macros: -* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) -Note that **detect_mshta_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_mshta_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ It is possible legitimate applications may perform this behavior and will need t | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $est$ by user $user$ attempting to access a remote destination to download an additional payload. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/AtomicTestHarnesses](https://github.com/redcanaryco/AtomicTestHarnesses) diff --git a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md index c18e14fc51..9789c28914 100644 --- a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md +++ b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md @@ -99,7 +99,7 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla -#### Search +#### Search ``` @@ -112,11 +112,12 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla #### Macros The SPL above uses the following Macros: +* [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml) -Note that **detect_psexec_with_accepteula_flag_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_psexec_with_accepteula_flag_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -156,6 +157,9 @@ Administrators can leverage PsExec for accessing remote systems and might pass ` | 35.0 | 50 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running the utility for possibly the first time. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-09-16-detect_renamed_7-zip.md b/docs/_posts/2021-09-16-detect_renamed_7-zip.md index d72fb5b2c8..6cf4262a27 100644 --- a/docs/_posts/2021-09-16-detect_renamed_7-zip.md +++ b/docs/_posts/2021-09-16-detect_renamed_7-zip.md @@ -94,7 +94,7 @@ The following analytic identifies renamed 7-Zip usage using Sysmon. At this stag -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_renamed_7-zip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_renamed_7-zip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ Limited false positives, however this analytic will need to be modified for each | 27.0 | 30 | 90 | The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md) diff --git a/docs/_posts/2021-09-16-detect_renamed_rclone.md b/docs/_posts/2021-09-16-detect_renamed_rclone.md index 9733c183e7..f2e57e8149 100644 --- a/docs/_posts/2021-09-16-detect_renamed_rclone.md +++ b/docs/_posts/2021-09-16-detect_renamed_rclone.md @@ -88,7 +88,7 @@ The following analytic identifies the usage of `rclone.exe`, renamed, being used -#### Search +#### Search ``` @@ -104,7 +104,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_renamed_rclone_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_renamed_rclone_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ False positives should be limited as this analytic identifies renamed instances | 27.0 | 30 | 90 | The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://redcanary.com/blog/rclone-mega-extortion/](https://redcanary.com/blog/rclone-mega-extortion/) diff --git a/docs/_posts/2021-09-16-detect_renamed_winrar.md b/docs/_posts/2021-09-16-detect_renamed_winrar.md index 85b64b50e0..0c7e7aa0d1 100644 --- a/docs/_posts/2021-09-16-detect_renamed_winrar.md +++ b/docs/_posts/2021-09-16-detect_renamed_winrar.md @@ -94,7 +94,7 @@ The following analtyic identifies renamed instances of `WinRAR.exe`. In most cas -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_renamed_winrar_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_renamed_winrar_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ Unknown. It is possible third party applications use renamed instances of WinRAR | 27.0 | 30 | 90 | The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md) diff --git a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md index fe4fdfff56..4a5fa98e9a 100644 --- a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md +++ b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md @@ -101,7 +101,7 @@ During triage, confirm this is procdump.exe executing. If it is the first time a -#### Search +#### Search ``` @@ -114,11 +114,12 @@ During triage, confirm this is procdump.exe executing. If it is the first time a #### Macros The SPL above uses the following Macros: -* [process_procdump](https://github.com/splunk/security_content/blob/develop/macros/process_procdump.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_procdump](https://github.com/splunk/security_content/blob/develop/macros/process_procdump.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **dump_lsass_via_procdump_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **dump_lsass_via_procdump_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ None identified. | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified attempting to dump lsass.exe on endpoint $dest$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1003/001/](https://attack.mitre.org/techniques/T1003/001/) diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_net.md b/docs/_posts/2021-09-16-local_account_discovery_with_net.md index c1132478d0..ae109b8453 100644 --- a/docs/_posts/2021-09-16-local_account_discovery_with_net.md +++ b/docs/_posts/2021-09-16-local_account_discovery_with_net.md @@ -94,7 +94,7 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li -#### Search +#### Search ``` @@ -108,10 +108,11 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -Note that **local_account_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **local_account_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,6 +137,9 @@ Administrators or power users may use this command for troubleshooting. | 15.0 | 30 | 50 | Local user discovery enumeration on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1087/001/](https://attack.mitre.org/techniques/T1087/001/) diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md index 8d529f0409..93b346f94f 100644 --- a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md +++ b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md @@ -94,7 +94,7 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **local_account_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **local_account_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,6 +137,9 @@ Administrators or power users may use this command for troubleshooting. | 15.0 | 30 | 50 | Local user discovery enumeration on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1087/001/](https://attack.mitre.org/techniques/T1087/001/) diff --git a/docs/_posts/2021-09-16-office_product_spawning_wmic.md b/docs/_posts/2021-09-16-office_product_spawning_wmic.md index 144765e29d..e633470995 100644 --- a/docs/_posts/2021-09-16-office_product_spawning_wmic.md +++ b/docs/_posts/2021-09-16-office_product_spawning_wmic.md @@ -94,7 +94,7 @@ The following detection identifies the latest behavior utilized by Ursnif malwar -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **office_product_spawning_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **office_product_spawning_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,6 +149,9 @@ No false positives known. Filter as needed. | 63.0 | 70 | 90 | office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://app.any.run/tasks/fb894ab8-a966-4b72-920b-935f41756afd/](https://app.any.run/tasks/fb894ab8-a966-4b72-920b-935f41756afd/) diff --git a/docs/_posts/2021-09-16-processes_launching_netsh.md b/docs/_posts/2021-09-16-processes_launching_netsh.md index ae2d1f9138..f97c6caf50 100644 --- a/docs/_posts/2021-09-16-processes_launching_netsh.md +++ b/docs/_posts/2021-09-16-processes_launching_netsh.md @@ -99,7 +99,7 @@ This search looks for processes launching netsh.exe. Netsh is a command-line scr -#### Search +#### Search ``` @@ -113,10 +113,11 @@ This search looks for processes launching netsh.exe. Netsh is a command-line scr #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **processes_launching_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **processes_launching_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ Some VPN applications are known to launch netsh.exe. Outside of these instances, | 42.0 | 60 | 70 | A process $process_name$ that tries to execute netsh commandline $process$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md index f5b8561193..171dba2732 100644 --- a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md +++ b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md @@ -94,7 +94,7 @@ This search is to detect potential malicious office document executing lolbin ch -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **office_document_spawned_child_process_to_download_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **office_document_spawned_child_process_to_download_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ Default browser not in the filter list. | 35.0 | 70 | 50 | Office document spawning suspicious child process on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/#](https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/#) diff --git a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md index abaddec961..e4ccf99289 100644 --- a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md +++ b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md @@ -89,7 +89,7 @@ This search is to detect file creation in remcos folder in appdata which is the -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **remcos_rat_file_creation_in_remcos_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **remcos_rat_file_creation_in_remcos_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,6 +135,9 @@ unknown | 100.0 | 100 | 100 | file $file_name$ created in $file_path$ of $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://success.trendmicro.com/solution/1123281-remcos-malware-information](https://success.trendmicro.com/solution/1123281-remcos-malware-information) diff --git a/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md b/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md index 8571c61c67..a9bff0a438 100644 --- a/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md +++ b/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md @@ -89,7 +89,7 @@ This search is to detect a suspicious creation of image in appdata folder made b -#### Search +#### Search ``` @@ -106,7 +106,8 @@ This search is to detect a suspicious creation of image in appdata folder made b The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **suspicious_image_creation_in_appdata_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_image_creation_in_appdata_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ unknown | 49.0 | 70 | 70 | process $process_name$ creating image file $file_path$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://success.trendmicro.com/solution/1123281-remcos-malware-information](https://success.trendmicro.com/solution/1123281-remcos-malware-information) diff --git a/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md b/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md index e6be7312e3..e201b94ed1 100644 --- a/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md +++ b/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md @@ -89,7 +89,7 @@ This analytic is to detect a suspicious creation of .wav file in appdata folder. -#### Search +#### Search ``` @@ -106,7 +106,8 @@ This analytic is to detect a suspicious creation of .wav file in appdata folder. The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **suspicious_wav_file_in_appdata_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_wav_file_in_appdata_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ unknown | 49.0 | 70 | 70 | process $process_name$ creating image file $file_path$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://success.trendmicro.com/solution/1123281-remcos-malware-information](https://success.trendmicro.com/solution/1123281-remcos-malware-information) diff --git a/docs/_posts/2021-09-27-change_default_file_association.md b/docs/_posts/2021-09-27-change_default_file_association.md index 8ae30e702f..d41d8d6193 100644 --- a/docs/_posts/2021-09-27-change_default_file_association.md +++ b/docs/_posts/2021-09-27-change_default_file_association.md @@ -96,7 +96,7 @@ This analytic is developed to detect suspicious registry modification to change -#### Search +#### Search ``` @@ -112,7 +112,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **change_default_file_association_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **change_default_file_association_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ unknown | 80.0 | 80 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features](https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features) diff --git a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md index 506a126990..0292c54669 100644 --- a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md +++ b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md @@ -96,7 +96,7 @@ This search is to detect a suspicious modification of registry entry to persist -#### Search +#### Search ``` @@ -112,7 +112,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **logon_script_event_trigger_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **logon_script_event_trigger_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ unknown | 80.0 | 80 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1037/001](https://attack.mitre.org/techniques/T1037/001) diff --git a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md index 1af008f14b..3a59bbf0df 100644 --- a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md +++ b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md @@ -96,7 +96,7 @@ This analytic is developed to detect possible event trigger execution through sc -#### Search +#### Search ``` @@ -112,7 +112,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **screensaver_event_trigger_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **screensaver_event_trigger_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ unknown | 72.0 | 80 | 90 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1546/002/](https://attack.mitre.org/techniques/T1546/002/) diff --git a/docs/_posts/2021-09-28-print_processor_registry_autostart.md b/docs/_posts/2021-09-28-print_processor_registry_autostart.md index 9df66a4e11..9f78548a3a 100644 --- a/docs/_posts/2021-09-28-print_processor_registry_autostart.md +++ b/docs/_posts/2021-09-28-print_processor_registry_autostart.md @@ -21,7 +21,7 @@ tags: - Endpoint --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -98,7 +98,7 @@ This analytic is to detect a suspicious modification or new registry entry regar -#### Search +#### Search ``` @@ -114,7 +114,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **print_processor_registry_autostart_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **print_processor_registry_autostart_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ possible new printer installation may add driver component on this registry. | 80.0 | 80 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1547/012/](https://attack.mitre.org/techniques/T1547/012/) diff --git a/docs/_posts/2021-09-29-verclsid_clsid_execution.md b/docs/_posts/2021-09-29-verclsid_clsid_execution.md index aae839d539..e0c80c97f6 100644 --- a/docs/_posts/2021-09-29-verclsid_clsid_execution.md +++ b/docs/_posts/2021-09-29-verclsid_clsid_execution.md @@ -1,7 +1,7 @@ --- title: "Verclsid CLSID Execution" excerpt: "Verclsid -, Signed Binary Proxy Execution +, System Binary Proxy Execution " categories: - Endpoint @@ -10,7 +10,7 @@ toc: true toc_label: "" tags: - Verclsid - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Defense Evasion - Defense Evasion - Splunk Enterprise @@ -47,7 +47,7 @@ This analytic is to detect a possible abuse of verclsid to execute malicious fil | -------------- | ---------------- |-------------------- | | [T1218.012](https://attack.mitre.org/techniques/T1218/012/) | Verclsid | Defense Evasion | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | @@ -94,7 +94,7 @@ This analytic is to detect a possible abuse of verclsid to execute malicious fil -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [process_verclsid](https://github.com/splunk/security_content/blob/develop/macros/process_verclsid.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **verclsid_clsid_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **verclsid_clsid_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ windows can used this application for its normal COM object validation. | 25.0 | 50 | 50 | process $process_name$ to execute possible clsid commandline $process$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5](https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5) diff --git a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md index 93eccdc423..2f4712acc7 100644 --- a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md +++ b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md @@ -94,7 +94,7 @@ This analytic is to detect a suspicious wscript commandline to execute vbscript. -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **vbscript_execution_using_wscript_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **vbscript_execution_using_wscript_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ unknown | 49.0 | 70 | 70 | Process name $process_name$ with commandline $process$ to execute vbsscript | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.joesandbox.com/analysis/369332/0/html](https://www.joesandbox.com/analysis/369332/0/html) diff --git a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md index 51926c89f6..4a130ec3ef 100644 --- a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md +++ b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md @@ -94,7 +94,7 @@ This analytic is to detect a suspicious child process of MSBuild spawned by Wind -#### Search +#### Search ``` @@ -107,11 +107,12 @@ This analytic is to detect a suspicious child process of MSBuild spawned by Wind #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **msbuild_suspicious_spawned_by_script_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **msbuild_suspicious_spawned_by_script_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ False positives should be limited as developers do not spawn MSBuild via a WSH. | 49.0 | 70 | 70 | Msbuild.exe process spawned by $parent_process_name$ on $dest$ executed by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/#](https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/#) diff --git a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md index ed0a8b85b7..7ab016e37d 100644 --- a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md +++ b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md @@ -1,6 +1,6 @@ --- title: "Regsvr32 Silent and Install Param Dll Loading" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Regsvr32 " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-10-04 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Regsvr32 - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ This analytic is to detect a loading of dll using regsvr32 application with sile | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.010](https://attack.mitre.org/techniques/T1218/010/) | Regsvr32 | Defense Evasion | @@ -94,7 +94,7 @@ This analytic is to detect a loading of dll using regsvr32 application with sile -#### Search +#### Search ``` @@ -113,7 +113,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) -Note that **regsvr32_silent_and_install_param_dll_loading_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **regsvr32_silent_and_install_param_dll_loading_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ Other third part application may used this parameter but not so common in base w | 36.0 | 60 | 60 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a DLL using the silent and dllinstall parameter. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/#](https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/#) diff --git a/docs/_posts/2021-10-05-detect_exchange_web_shell.md b/docs/_posts/2021-10-05-detect_exchange_web_shell.md index 787e32638e..64a4f4bb66 100644 --- a/docs/_posts/2021-10-05-detect_exchange_web_shell.md +++ b/docs/_posts/2021-10-05-detect_exchange_web_shell.md @@ -99,7 +99,7 @@ The following query identifies suspicious .aspx created in 3 paths identified by -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The following query identifies suspicious .aspx created in 3 paths identified by The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_exchange_web_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_exchange_web_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ The query is structured in a way that `action` (read, create) is not defined. Re | 81.0 | 90 | 90 | A file - $file_name$ was written to disk that is related to IIS exploitation previously performed by HAFNIUM. Review further file modifications on endpoint $dest$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv) diff --git a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md index 49254a1693..c92dd507b1 100644 --- a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md +++ b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md @@ -94,7 +94,7 @@ The following analytic identifies a process modifying the registry with a known -#### Search +#### Search ``` @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **malicious_inprocserver32_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **malicious_inprocserver32_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ False positives should be limited, filter as needed. In our test case, Remcos us | 80.0 | 80 | 100 | The $process_name$ was identified on endpoint $dest$ modifying the registry with a known malicious clsid under InProcServer32. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/](https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/) diff --git a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md index 8747932fef..694d3b6d87 100644 --- a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md +++ b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md @@ -94,7 +94,7 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win -#### Search +#### Search ``` @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **process_writing_dynamicwrapperx_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **process_writing_dynamicwrapperx_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ False positives should be limited, however it is possible to filter by Processes | 80.0 | 80 | 100 | An instance of $process_name$ was identified on endpoint $dest$ downloading the DynamicWrapperX dll. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/](https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/) diff --git a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md index d803a4d524..bdc14982b0 100644 --- a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md +++ b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md @@ -89,7 +89,7 @@ This analytic is to detect a suspicious rundll32 commandline to clear shim cache -#### Search +#### Search ``` @@ -102,11 +102,12 @@ This analytic is to detect a suspicious rundll32 commandline to clear shim cache #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -Note that **rundll32_shimcache_flush_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **rundll32_shimcache_flush_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ unknown | 80.0 | 80 | 100 | rundll32 process execute $process$ to clear shim cache in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://blueteamops.medium.com/shimcache-flush-89daff28d15e](https://blueteamops.medium.com/shimcache-flush-89daff28d15e) diff --git a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md index dc4e414474..af63f529d2 100644 --- a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md +++ b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md @@ -94,7 +94,7 @@ This analytic is to detect a suspicious copy of file from systemroot folder of t -#### Search +#### Search ``` @@ -108,10 +108,11 @@ This analytic is to detect a suspicious copy of file from systemroot folder of t #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_copy](https://github.com/splunk/security_content/blob/develop/macros/process_copy.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_copy](https://github.com/splunk/security_content/blob/develop/macros/process_copy.yml) -Note that **suspicious_copy_on_system32_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_copy_on_system32_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ every user may do this event but very un-ussual. | 63.0 | 70 | 90 | execution of copy exe to copy file from $process$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120](https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120) diff --git a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md index 9d6a5d0398..fde853a427 100644 --- a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md +++ b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md @@ -90,7 +90,7 @@ The following analytic identifies winhlp32.exe, found natively in `c:\windows\`, -#### Search +#### Search ``` @@ -106,7 +106,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **winhlp32_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **winhlp32_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ False positives should be limited as winhlp32.exe is typically not used with the | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$, and is not typical activity for this process. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.exploit-db.com/exploits/16541](https://www.exploit-db.com/exploits/16541) diff --git a/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md b/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md index bde26d3d18..7072ad7733 100644 --- a/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md +++ b/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md @@ -1,6 +1,6 @@ --- title: "DNS Query Length With High Standard Deviation" -excerpt: "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol +excerpt: "Exfiltration Over Unencrypted Non-C2 Protocol , Exfiltration Over Alternative Protocol " categories: @@ -9,7 +9,7 @@ last_modified_at: 2021-10-06 toc: true toc_label: "" tags: - - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol + - Exfiltration Over Unencrypted Non-C2 Protocol - Exfiltration Over Alternative Protocol - Exfiltration - Exfiltration @@ -45,7 +45,7 @@ This search allows you to identify DNS requests and compute the standard deviati | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration | +| [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted Non-C2 Protocol | Exfiltration | | [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration | @@ -101,7 +101,7 @@ This search allows you to identify DNS requests and compute the standard deviati -#### Search +#### Search ``` @@ -123,7 +123,8 @@ This search allows you to identify DNS requests and compute the standard deviati The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **dns_query_length_with_high_standard_deviation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **dns_query_length_with_high_standard_deviation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ It's possible there can be long domain names that are legitimate. | 56.0 | 70 | 80 | A dns query $query$ with 2 time standard deviation of name len of the dns query in host $host$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-10-06-sdelete_application_execution.md b/docs/_posts/2021-10-06-sdelete_application_execution.md index df806ce712..959a2f8873 100644 --- a/docs/_posts/2021-10-06-sdelete_application_execution.md +++ b/docs/_posts/2021-10-06-sdelete_application_execution.md @@ -99,7 +99,7 @@ This analytic is to detect the execution of sdelete.exe application sysinternal -#### Search +#### Search ``` @@ -113,10 +113,11 @@ This analytic is to detect the execution of sdelete.exe application sysinternal #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_sdelete](https://github.com/splunk/security_content/blob/develop/macros/process_sdelete.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_sdelete](https://github.com/splunk/security_content/blob/develop/macros/process_sdelete.yml) -Note that **sdelete_application_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **sdelete_application_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,6 +153,9 @@ user may execute and use this application | 49.0 | 70 | 70 | sdelete process $process_name$ executed in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://app.any.run/tasks/956f50be-2c13-465a-ac00-6224c14c5f89/](https://app.any.run/tasks/956f50be-2c13-465a-ac00-6224c14c5f89/) diff --git a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md index 8b6c44eee0..cec7e8608e 100644 --- a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md +++ b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md @@ -108,7 +108,7 @@ This analytic identifies a suspicious spawned process by WScript or CScript proc -#### Search +#### Search ``` @@ -124,7 +124,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **wscript_or_cscript_suspicious_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **wscript_or_cscript_suspicious_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -163,6 +164,9 @@ Administrators may create vbs or js script that use several tool as part of its | 49.0 | 70 | 70 | wscript or cscript parent process spawned $process_name$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120](https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120) diff --git a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md index cd4a04eb2e..01e8f5d298 100644 --- a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md +++ b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md @@ -105,7 +105,7 @@ The wevtutil.exe application is the windows event log utility. This searches for -#### Search +#### Search ``` @@ -121,7 +121,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **suspicious_wevtutil_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_wevtutil_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ The wevtutil.exe application is a legitimate Windows event log utility. Administ | 28.0 | 40 | 70 | Wevtutil.exe being used to clear Event Logs on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md) diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md index a39874b958..7d8a265fee 100644 --- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md +++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md @@ -92,7 +92,7 @@ During triage, review parallel processes for further suspicious activity. -#### Search +#### Search ``` `powershell` EventCode=4104 Message="*KerberosRequestorSecurityToken*" @@ -107,7 +107,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **serviceprincipalnames_discovery_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **serviceprincipalnames_discovery_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ False positives should be limited, however filter as needed. | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to identify service principle names. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.microsoft.com/en-us/windows/win32/ad/service-principal-names](https://docs.microsoft.com/en-us/windows/win32/ad/service-principal-names) diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md index 7afbb57083..e51d62326e 100644 --- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md +++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md @@ -96,7 +96,7 @@ During triage, review parallel processes for further suspicious activity. -#### Search +#### Search ``` @@ -113,7 +113,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_setspn](https://github.com/splunk/security_content/blob/develop/macros/process_setspn.yml) -Note that **serviceprincipalnames_discovery_with_setspn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **serviceprincipalnames_discovery_with_setspn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,6 +151,9 @@ False positives may be caused by Administrators resetting SPNs or querying for S | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to identify service principle names. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.microsoft.com/en-us/windows/win32/ad/service-principal-names](https://docs.microsoft.com/en-us/windows/win32/ad/service-principal-names) diff --git a/docs/_posts/2021-10-18-disable_schedule_task.md b/docs/_posts/2021-10-18-disable_schedule_task.md index e6d6ad8dc6..b3fc9ce166 100644 --- a/docs/_posts/2021-10-18-disable_schedule_task.md +++ b/docs/_posts/2021-10-18-disable_schedule_task.md @@ -94,7 +94,7 @@ This analytic is to detect a suspicious commandline to disable existing schedule -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **disable_schedule_task_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disable_schedule_task_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +141,9 @@ admin may disable problematic schedule task | 56.0 | 70 | 80 | schtask process with commandline $process$ to disable schedule task in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/) diff --git a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md index af76259510..75b21d520d 100644 --- a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md +++ b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md @@ -91,7 +91,7 @@ During triage, review parallel processes for further behavior. In addition, iden -#### Search +#### Search ``` @@ -105,10 +105,11 @@ During triage, review parallel processes for further behavior. In addition, iden #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_curl_download_to_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_curl_download_to_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ It is possible Administrators or super users will use Curl for legitimate purpos | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ to download a file to a suspicious directory. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/) diff --git a/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md b/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md index 38026890be..dd3314e445 100644 --- a/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md +++ b/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md @@ -91,7 +91,7 @@ The following hunting analytic assists with identifying suspicious tasks that ha -#### Search +#### Search ``` `wineventlog_task_scheduler` EventCode IN ("200","201") @@ -107,7 +107,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_task_scheduler](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_task_scheduler.yml) -Note that **winevent_windows_task_scheduler_event_action_started_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **winevent_windows_task_scheduler_event_action_started_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ False positives will be present. Filter based on ActionName paths or specify key | 80.0 | 80 | 100 | A Scheduled Task was scheduled and ran on $dest$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.005/T1053.005.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.005/T1053.005.md) diff --git a/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md b/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md index 34dbc67041..aaa3c6c1e5 100644 --- a/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md +++ b/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md @@ -94,7 +94,7 @@ This analytic is to detect a suspicious wmic commandlined that uninstall applica -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **wmic_noninteractive_app_uninstallation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **wmic_noninteractive_app_uninstallation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ third party application may use this approach to uninstall there application | 25.0 | 50 | 50 | wmic $process$ with commandline $process$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/) diff --git a/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md b/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md index 13ccb03567..ee1b9b343c 100644 --- a/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md +++ b/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md @@ -15,7 +15,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -90,7 +90,7 @@ This search can help the detection of compromised accounts or internal users sha -#### Search +#### Search ``` `gsuite_drive` name=change_user_access @@ -105,7 +105,8 @@ This search can help the detection of compromised accounts or internal users sha The SPL above uses the following Macros: * [gsuite_drive](https://github.com/splunk/security_content/blob/develop/macros/gsuite_drive.yml) -Note that **gdrive_suspicious_file_sharing_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **gdrive_suspicious_file_sharing_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,6 +137,9 @@ This is an anomaly search, you must specify your domain in the parameters so it | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.splunk.com/en_us/blog/security/investigating-gsuite-phishing-attacks-with-splunk.html](https://www.splunk.com/en_us/blog/security/investigating-gsuite-phishing-attacks-with-splunk.html) diff --git a/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md b/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md index f39f15d3f2..05fa8f1fd1 100644 --- a/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md +++ b/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md @@ -15,7 +15,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -90,7 +90,7 @@ This search can help the detection of compromised accounts or internal users sen -#### Search +#### Search ``` `gsuite_calendar` @@ -106,7 +106,8 @@ This search can help the detection of compromised accounts or internal users sen The SPL above uses the following Macros: * [gsuite_calendar](https://github.com/splunk/security_content/blob/develop/macros/gsuite_calendar.yml) -Note that **gsuite_suspicious_calendar_invite_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **gsuite_suspicious_calendar_invite_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,6 +136,9 @@ This search will also produce normal activity statistics. Fields such as email, | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.techrepublic.com/article/how-to-avoid-the-dreaded-google-calendar-malicious-invite-issue/](https://www.techrepublic.com/article/how-to-avoid-the-dreaded-google-calendar-malicious-invite-issue/) diff --git a/docs/_posts/2021-11-03-windows_adfind_exe.md b/docs/_posts/2021-11-03-windows_adfind_exe.md index 1769732a32..ae27f6c24e 100644 --- a/docs/_posts/2021-11-03-windows_adfind_exe.md +++ b/docs/_posts/2021-11-03-windows_adfind_exe.md @@ -94,7 +94,7 @@ This search looks for the execution of `adfind.exe` with command-line arguments -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_adfind_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_adfind_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ administrators rarely use adfind, usually not used for legitimate reasons | 25.0 | 50 | 50 | Windows AdFind Exe | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/](https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/) diff --git a/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md b/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md index 6763edb348..f1d5e42897 100644 --- a/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md +++ b/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md @@ -111,7 +111,7 @@ This search looks for execution of commonly used attacker tools on an endpoint. -#### Search +#### Search ``` @@ -129,7 +129,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **attacker_tools_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **attacker_tools_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -165,6 +166,9 @@ Some administrator activity can be potentially triggered, please add those users | 64.0 | 80 | 80 | An attacker tool $process_name$,listed in attacker_tools.csv is executed on host $dest$ by User $user$. This process $process_name$ is known to do- $description$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md index 9ad22d52be..d15ce784b4 100644 --- a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md +++ b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md @@ -93,7 +93,7 @@ Adversaries may use one of the three methods based on the remote destination and -#### Search +#### Search ``` @@ -107,10 +107,11 @@ Adversaries may use one of the three methods based on the remote destination and #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_curl_upload_to_remote_destination_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_curl_upload_to_remote_destination_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ False positives may be limited to source control applications and may be require | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ uploading a file to a remote destination. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://everything.curl.dev/usingcurl/uploads](https://everything.curl.dev/usingcurl/uploads) diff --git a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md index bd1d6a25a8..5da833e578 100644 --- a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md +++ b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md @@ -96,7 +96,7 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut -#### Search +#### Search ``` @@ -112,7 +112,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_service_creation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_service_creation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,6 +149,9 @@ Administrators may create Windows Services on remote systems, but this activity | 54.0 | 90 | 60 | A Windows Service was created on a remote endpoint from $dest | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager](https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager) diff --git a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md index 46644e0440..cbc8075766 100644 --- a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md +++ b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md @@ -96,7 +96,7 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut -#### Search +#### Search ``` @@ -112,7 +112,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_service_initiation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_service_initiation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,6 +149,9 @@ Administrators may start Windows Services on remote systems, but this activity i | 54.0 | 90 | 60 | A Windows Service was started on a remote endpoint from $dest | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc](https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc) diff --git a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md index fa7df12edc..b076df1d77 100644 --- a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md +++ b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md @@ -94,7 +94,7 @@ This analytic looks for the execution of `winrs.exe` with command-line arguments -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **remote_process_instantiation_via_winrm_and_winrs_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **remote_process_instantiation_via_winrm_and_winrs_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ Administrators may leverage WinRM and WinRs to start a process on remote systems | 54.0 | 90 | 60 | A process was started on a remote endpoint from $dest | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/winrs](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/winrs) diff --git a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md index 50897dd101..87e1989c94 100644 --- a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md +++ b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md @@ -1,7 +1,7 @@ --- title: "Scheduled Task Creation on Remote Endpoint using At" excerpt: "Scheduled Task/Job -, At (Windows) +, At " categories: - Endpoint @@ -10,7 +10,7 @@ toc: true toc_label: "" tags: - Scheduled Task/Job - - At (Windows) + - At - Execution - Persistence - Privilege Escalation @@ -51,7 +51,7 @@ This analytic looks for the execution of `at.exe` with command-line arguments ut | -------------- | ---------------- |-------------------- | | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | -| [T1053.002](https://attack.mitre.org/techniques/T1053/002/) | At (Windows) | Execution, Persistence, Privilege Escalation | +| [T1053.002](https://attack.mitre.org/techniques/T1053/002/) | At | Execution, Persistence, Privilege Escalation | @@ -98,7 +98,7 @@ This analytic looks for the execution of `at.exe` with command-line arguments ut -#### Search +#### Search ``` @@ -114,7 +114,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **scheduled_task_creation_on_remote_endpoint_using_at_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **scheduled_task_creation_on_remote_endpoint_using_at_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ Administrators may create scheduled tasks on remote systems, but this activity i | 54.0 | 90 | 60 | A Windows Scheduled Task was created on a remote endpoint from $dest | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/at](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/at) diff --git a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md index 47e376285d..8594dd3d1e 100644 --- a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md +++ b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md @@ -98,7 +98,7 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume -#### Search +#### Search ``` @@ -114,7 +114,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **scheduled_task_initiation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **scheduled_task_initiation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ Administrators may start scheduled tasks on remote systems, but this activity is | 54.0 | 90 | 60 | A Windows Scheduled Task was ran on a remote endpoint from $dest | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks) diff --git a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md index 0d36f267ca..4486bf3aa2 100644 --- a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md +++ b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md @@ -89,7 +89,7 @@ The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible St -#### Search +#### Search ``` @@ -106,7 +106,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **wmic_xsl_execution_via_url_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **wmic_xsl_execution_via_url_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ False positives are limited as legitimate applications typically do not download | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing wmic to download a remote XSL script. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md) diff --git a/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md b/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md index aa132497d0..3dae7a3ebd 100644 --- a/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md +++ b/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md @@ -88,7 +88,7 @@ The following detection identifies excessive AccessDenied events within an hour -#### Search +#### Search ``` `cloudtrail` (errorCode = "AccessDenied") user_type=IAMUser (userAgent!=*.amazonaws.com) @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_iam_accessdenied_discovery_events_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_iam_accessdenied_discovery_events_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,6 +136,9 @@ It is possible to start this detection will need to be tuned by source IP or use | 10.0 | 20 | 50 | User $userIdentity.arn$ is seen to perform excessive number of discovery related api calls- $failures$, within an hour where the access was denied. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/](https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/) diff --git a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md index 5c5749602a..6b95e7c65b 100644 --- a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md +++ b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md @@ -94,7 +94,7 @@ this analytic is to detect a suspicious compile before delivery approach of .net -#### Search +#### Search ``` @@ -108,10 +108,11 @@ this analytic is to detect a suspicious compile before delivery approach of .net #### Macros The SPL above uses the following Macros: * [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **csc_net_on_the_fly_compilation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **csc_net_on_the_fly_compilation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ A network operator or systems administrator may utilize an automated powershell | 25.0 | 50 | 50 | csc.exe with commandline $process$ to compile .net code on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/](https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/) diff --git a/docs/_posts/2021-11-12-firewall_allowed_program_enable.md b/docs/_posts/2021-11-12-firewall_allowed_program_enable.md index ee0970c83f..51fc80ad1b 100644 --- a/docs/_posts/2021-11-12-firewall_allowed_program_enable.md +++ b/docs/_posts/2021-11-12-firewall_allowed_program_enable.md @@ -94,7 +94,7 @@ This analytic detects a potential suspicious modification of firewall rule allow -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **firewall_allowed_program_enable_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **firewall_allowed_program_enable_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ A network operator or systems administrator may utilize an automated or manual e | 25.0 | 50 | 50 | firewall allowed program commandline $process$ of $process_name$ on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/#](https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/#) diff --git a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md index 65452447dc..51716ce843 100644 --- a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md +++ b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md @@ -94,7 +94,7 @@ This analytic look for a spawned process of route.exe windows application. Adver -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [process_route](https://github.com/splunk/security_content/blob/develop/macros/process_route.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **network_discovery_using_route_windows_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **network_discovery_using_route_windows_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ A network operator or systems administrator may utilize an automated host discov | 9.0 | 30 | 30 | Network Connection discovery on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/#](https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/#) diff --git a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md index ee2d30c1db..ebc2459ed9 100644 --- a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md +++ b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md @@ -97,7 +97,7 @@ This analytic identifies wmic.exe being launched with parameters to spawn a proc -#### Search +#### Search ``` @@ -114,7 +114,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **remote_process_instantiation_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **remote_process_instantiation_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,6 +153,9 @@ The wmic.exe utility is a benign Windows application. It may be used legitimatel | 49.0 | 70 | 70 | A wmic.exe process $process$ contain process spawn commandline $process$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1047/](https://attack.mitre.org/techniques/T1047/) diff --git a/docs/_posts/2021-11-12-runas_execution_in_commandline.md b/docs/_posts/2021-11-12-runas_execution_in_commandline.md index 375563872c..8d93a290a6 100644 --- a/docs/_posts/2021-11-12-runas_execution_in_commandline.md +++ b/docs/_posts/2021-11-12-runas_execution_in_commandline.md @@ -96,7 +96,7 @@ This analytic look for a spawned runas.exe process with a administrator user opt -#### Search +#### Search ``` @@ -110,10 +110,11 @@ This analytic look for a spawned runas.exe process with a administrator user opt #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_runas](https://github.com/splunk/security_content/blob/develop/macros/process_runas.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_runas](https://github.com/splunk/security_content/blob/develop/macros/process_runas.yml) -Note that **runas_execution_in_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **runas_execution_in_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ A network operator or systems administrator may utilize an automated or manual e | 25.0 | 50 | 50 | elevated process using runas on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/#](https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/#) diff --git a/docs/_posts/2021-11-12-windows_installutil_credential_theft.md b/docs/_posts/2021-11-12-windows_installutil_credential_theft.md index d25d97cd46..27158377d4 100644 --- a/docs/_posts/2021-11-12-windows_installutil_credential_theft.md +++ b/docs/_posts/2021-11-12-windows_installutil_credential_theft.md @@ -1,7 +1,7 @@ --- title: "Windows InstallUtil Credential Theft" excerpt: "InstallUtil -, Signed Binary Proxy Execution +, System Binary Proxy Execution " categories: - Endpoint @@ -10,7 +10,7 @@ toc: true toc_label: "" tags: - InstallUtil - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Defense Evasion - Defense Evasion - Splunk Enterprise @@ -50,7 +50,7 @@ During triage review resulting network connections, file modifications, and para | -------------- | ---------------- |-------------------- | | [T1218.004](https://attack.mitre.org/techniques/T1218/004/) | InstallUtil | Defense Evasion | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | @@ -97,7 +97,7 @@ During triage review resulting network connections, file modifications, and para -#### Search +#### Search ``` `sysmon` EventCode=7 process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll", "*\\vaultcli.dll") @@ -113,7 +113,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **windows_installutil_credential_theft_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_installutil_credential_theft_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ Typically this will not trigger as by it's very nature InstallUtil does not need | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ loading samlib.dll and vaultcli.dll to potentially capture credentials in memory. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://gist.github.com/xorrior/bbac3919ca2aef8d924bdf3b16cce3d0](https://gist.github.com/xorrior/bbac3919ca2aef8d924bdf3b16cce3d0) diff --git a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md index 7631ae666a..6034d0ff53 100644 --- a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md +++ b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md @@ -1,7 +1,7 @@ --- title: "Windows InstallUtil Uninstall Option" excerpt: "InstallUtil -, Signed Binary Proxy Execution +, System Binary Proxy Execution " categories: - Endpoint @@ -10,7 +10,7 @@ toc: true toc_label: "" tags: - InstallUtil - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Defense Evasion - Defense Evasion - Splunk Enterprise @@ -51,7 +51,7 @@ During triage review resulting network connections, file modifications, and para | -------------- | ---------------- |-------------------- | | [T1218.004](https://attack.mitre.org/techniques/T1218/004/) | InstallUtil | Defense Evasion | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | @@ -98,7 +98,7 @@ During triage review resulting network connections, file modifications, and para -#### Search +#### Search ``` @@ -111,11 +111,12 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) -Note that **windows_installutil_uninstall_option_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_installutil_uninstall_option_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,6 +153,9 @@ Limited false positives should be present. Filter as needed by parent process or | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing an uninstall. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12](https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12) diff --git a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md index 075c3b7477..31931f9bdd 100644 --- a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md +++ b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md @@ -1,7 +1,7 @@ --- title: "Windows InstallUtil URL in Command Line" excerpt: "InstallUtil -, Signed Binary Proxy Execution +, System Binary Proxy Execution " categories: - Endpoint @@ -10,7 +10,7 @@ toc: true toc_label: "" tags: - InstallUtil - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Defense Evasion - Defense Evasion - Splunk Enterprise @@ -50,7 +50,7 @@ During triage review resulting network connections, file modifications, and para | -------------- | ---------------- |-------------------- | | [T1218.004](https://attack.mitre.org/techniques/T1218/004/) | InstallUtil | Defense Evasion | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | @@ -97,7 +97,7 @@ During triage review resulting network connections, file modifications, and para -#### Search +#### Search ``` @@ -110,11 +110,12 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) -Note that **windows_installutil_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_installutil_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ Limited false positives should be present as InstallUtil is not typically used t | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ passing a URL on the command-line. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md) diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md index 4ed305aa61..66a651a0c7 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md @@ -94,7 +94,7 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -Note that **remote_process_instantiation_via_dcom_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **remote_process_instantiation_via_dcom_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ Administrators may leverage DCOM to start a process on remote systems, but this | 63.0 | 90 | 70 | A process was started on a remote endpoint from $dest by abusing DCOM using PowerShell.exe | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1021/003/](https://attack.mitre.org/techniques/T1021/003/) diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md index 399701388e..e60efaba09 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md @@ -89,7 +89,7 @@ This analytic looks for the execution of `powershell.exe` leveraging the `Invoke -#### Search +#### Search ``` @@ -106,7 +106,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -Note that **remote_process_instantiation_via_wmi_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **remote_process_instantiation_via_wmi_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ Administrators may leverage WWMI and powershell.exe to start a process on remote | 63.0 | 90 | 70 | A process was started on a remote endpoint from $dest by abusing WMI using PowerShell.exe | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1047/](https://attack.mitre.org/techniques/T1047/) diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md index 818980ef36..757fbfe201 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md @@ -88,7 +88,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 (Message="*Invoke-WmiMethod*" AND Message="*-CN*" AND Message="*-Class Win32_Process*" AND Message="*-Name create*") @@ -102,7 +102,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **remote_process_instantiation_via_wmi_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **remote_process_instantiation_via_wmi_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,6 +132,9 @@ Administrators may leverage WWMI and powershell.exe to start a process on remote | 63.0 | 90 | 70 | A process was started on a remote endpoint from $ComputerName by abusing WMI using PowerShell.exe | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1047/](https://attack.mitre.org/techniques/T1047/) diff --git a/docs/_posts/2021-11-15-windows_diskcryptor_usage.md b/docs/_posts/2021-11-15-windows_diskcryptor_usage.md index e726f94dda..22e2d22d41 100644 --- a/docs/_posts/2021-11-15-windows_diskcryptor_usage.md +++ b/docs/_posts/2021-11-15-windows_diskcryptor_usage.md @@ -89,7 +89,7 @@ The following analytic identifies DiskCryptor process name of dcrypt.exe or int -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_diskcryptor_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_diskcryptor_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ It is possible false positives may be present based on the internal name dcinst. | 35.0 | 70 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to encrypt disks. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/](https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/) diff --git a/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md b/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md index 42e6991bd8..ac222ae88d 100644 --- a/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md +++ b/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md @@ -89,7 +89,7 @@ This analytic is to detect a suspicious high frequency copying/moving of files i -#### Search +#### Search ``` `wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.doc","*.docx","*.xls","*.xlsx","*.ppt","*.pptx","*.log","*.txt","*.db","*.7z","*.zip","*.rar","*.tar","*.gz","*.jpg","*.gif","*.png","*.bmp","*.pdf","*.rtf","*.key") Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask= "0x2" @@ -106,7 +106,8 @@ This analytic is to detect a suspicious high frequency copying/moving of files i The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **high_frequency_copy_of_files_in_network_share_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **high_frequency_copy_of_files_in_network_share_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +141,9 @@ this behavior may seen in normal transfer of file within network if network shar | 9.0 | 30 | 30 | high frequency copy of document in network share $Share_Name$ from $Source_Address$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1537/](https://attack.mitre.org/techniques/T1537/) diff --git a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md index 447c29836d..b888da59c0 100644 --- a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md +++ b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md @@ -94,7 +94,7 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -Note that **remote_process_instantiation_via_winrm_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **remote_process_instantiation_via_winrm_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ Administrators may leverage WinRM and `Invoke-Command` to start a process on rem | 45.0 | 90 | 50 | A process was started on a remote endpoint from $dest by abusing WinRM using PowerShell.exe | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1021/006/](https://attack.mitre.org/techniques/T1021/006/) diff --git a/docs/_posts/2021-11-17-windows_dism_remove_defender.md b/docs/_posts/2021-11-17-windows_dism_remove_defender.md index dae832c419..8284fef570 100644 --- a/docs/_posts/2021-11-17-windows_dism_remove_defender.md +++ b/docs/_posts/2021-11-17-windows_dism_remove_defender.md @@ -94,7 +94,7 @@ The following analytic identifies the use of the Windows Disk Image Utility, `di -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_dism_remove_defender_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_dism_remove_defender_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ Some legitimate administrative tools leverage `dism.exe` to manipulate packages | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to disable Windows Defender. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/](https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/) diff --git a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md index 76ddaa8e26..33e561285b 100644 --- a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md +++ b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md @@ -93,7 +93,7 @@ The following analytic identifies executable files (.exe or .dll) being written -#### Search +#### Search ``` `wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.exe","*.dll") Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask= "0x2" @@ -105,10 +105,11 @@ The following analytic identifies executable files (.exe or .dll) being written #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **executable_file_written_in_administrative_smb_share_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **executable_file_written_in_administrative_smb_share_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ System Administrators may use looks like PsExec for troubleshooting or administr | 70.0 | 70 | 100 | $user$ dropped or created an executable file in known sensitive SMB share. Share name=$Share_Name$, Target name=$Relative_Target_Name$, and Access mask=$Access_Mask$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1021/002/](https://attack.mitre.org/techniques/T1021/002/) diff --git a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md index e9f1268bfa..3ae1f562ee 100644 --- a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md +++ b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md @@ -96,7 +96,7 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win -#### Search +#### Search ``` `sysmon` EventCode=7 (ImageLoaded = "*\\dynwrapx.dll" OR OriginalFileName = "dynwrapx.dll" OR Product = "DynamicWrapperX") @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **loading_of_dynwrapx_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **loading_of_dynwrapx_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ False positives should be limited, however it is possible to filter by Processes | 80.0 | 80 | 100 | dynwrapx.dll loaded by process $process_name$ on $Computer$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/](https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/) diff --git a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md index af5f66362a..e331263a76 100644 --- a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md +++ b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md @@ -89,7 +89,7 @@ This analytic is to detect a suspicious dxdiag.exe process command-line executio -#### Search +#### Search ``` @@ -106,7 +106,8 @@ The SPL above uses the following Macros: * [process_dxdiag](https://github.com/splunk/security_content/blob/develop/macros/process_dxdiag.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **system_info_gathering_using_dxdiag_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **system_info_gathering_using_dxdiag_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ This commandline can be used by a network administrator to audit host machine sp | 25.0 | 50 | 50 | dxdiag.exe process with commandline $process$ on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/](https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/) diff --git a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md index 4dd9f3d668..caf3384e1f 100644 --- a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md +++ b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md @@ -94,7 +94,7 @@ This analytic will detect if a suspicious process contains a commandline paramet -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **possible_browser_pass_view_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **possible_browser_pass_view_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ False positive is quite limited. Filter is needed | 16.0 | 40 | 40 | suspicious process $process_name$ contains commandline $process$ on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.nirsoft.net/utils/web_browser_password.html](https://www.nirsoft.net/utils/web_browser_password.html) diff --git a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md index 5fc0ccd7c7..7bd3bee68c 100644 --- a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md @@ -96,7 +96,7 @@ The following analytic identifies `services.exe` spawning a LOLBAS execution pro -#### Search +#### Search ``` @@ -112,7 +112,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **services_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **services_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ Legitimate applications may trigger this behavior, filter as needed. | 54.0 | 90 | 60 | Services.exe spawned a LOLBAS process on $dest | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1543/003/](https://attack.mitre.org/techniques/T1543/003/) diff --git a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md index c3af210dfa..34e506259e 100644 --- a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md @@ -98,7 +98,7 @@ The following analytic identifies `svchost.exe` spawning a LOLBAS execution proc -#### Search +#### Search ``` @@ -114,7 +114,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **svchost_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **svchost_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ Legitimate applications may trigger this behavior, filter as needed. | 54.0 | 90 | 60 | Svchost.exe spawned a LOLBAS process on $dest | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1053/005/](https://attack.mitre.org/techniques/T1053/005/) diff --git a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md index 7c77939efa..4eaf9368be 100644 --- a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md +++ b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md @@ -93,7 +93,7 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t -#### Search +#### Search ``` `wineventlog_system` EventCode=7045 Service_File_Name = "*\.exe" NOT (Service_File_Name IN ("C:\\Windows\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*")) @@ -108,7 +108,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) -Note that **windows_service_created_with_suspicious_service_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_service_created_with_suspicious_service_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * EventCode @@ -139,6 +140,9 @@ Legitimate applications may install services with uncommon services paths. | 56.0 | 70 | 80 | A service $Service_File_Name$ was created from a non-standard path using $Service_Name$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html](https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html) diff --git a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md index 7277da4ebd..95e77dbca5 100644 --- a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md +++ b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md @@ -95,7 +95,7 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t -#### Search +#### Search ``` `wineventlog_system` EventCode=7045 Service_File_Name = "*\.exe" NOT (Service_File_Name IN ("C:\\Windows\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*")) @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) -Note that **windows_service_created_within_public_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_service_created_within_public_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * EventCode @@ -140,6 +141,9 @@ Legitimate applications may install services with uncommon services paths. | 54.0 | 90 | 60 | A Windows Service $Service_File_Name$ with a public path was created on $ComputerName | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager](https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager) diff --git a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md index 84debcfd02..099eac2a44 100644 --- a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md @@ -89,7 +89,7 @@ The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution pro -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **wmiprsve_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **wmiprsve_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ Legitimate applications may trigger this behavior, filter as needed. | 54.0 | 90 | 60 | Wmiprsve.exe spawned a LOLBAS process on $dest$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1047/](https://attack.mitre.org/techniques/T1047/) diff --git a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md index d79bd8c041..db4463390b 100644 --- a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md @@ -94,7 +94,7 @@ The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS execution -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **wsmprovhost_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **wsmprovhost_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ Legitimate applications may trigger this behavior, filter as needed. | 54.0 | 90 | 60 | Wsmprovhost.exe spawned a LOLBAS process on $dest$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1021/006/](https://attack.mitre.org/techniques/T1021/006/) diff --git a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md index 8408987baa..bbc252e457 100644 --- a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md @@ -94,7 +94,7 @@ The following analytic identifies `mmc.exe` spawning a LOLBAS execution process. -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **mmc_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **mmc_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ Legitimate applications may trigger this behavior, filter as needed. | 54.0 | 90 | 60 | Mmc.exe spawned a LOLBAS process on $dest | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1021/003/](https://attack.mitre.org/techniques/T1021/003/) diff --git a/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md b/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md index 7a1b2fabea..d8c3a3325e 100644 --- a/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md +++ b/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md @@ -94,7 +94,7 @@ This analytic will identify a suspicious process command-line related to Windows -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **add_or_set_windows_defender_exclusion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **add_or_set_windows_defender_exclusion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,6 +149,9 @@ Admin or user may choose to use this windows features. Filter as needed. | 64.0 | 80 | 80 | exclusion command $process$ executed on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html](https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html) diff --git a/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md b/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md index a80231b3b5..390824b54a 100644 --- a/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md +++ b/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md @@ -94,7 +94,7 @@ This analytic will detect a suspicious process commandline related to windows de -#### Search +#### Search ``` `powershell` EventCode=4104 (Message = "*Add-MpPreference *" OR Message = "*Set-MpPreference *") AND Message = "*-exclusion*" @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **powershell_windows_defender_exclusion_commands_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **powershell_windows_defender_exclusion_commands_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +141,9 @@ admin or user may choose to use this windows features. | 64.0 | 80 | 80 | exclusion command $Message$ executed on $ComputerName$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html](https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html) diff --git a/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md b/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md index 1eaa2cddfd..0fde2be7d5 100644 --- a/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md +++ b/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md @@ -94,7 +94,7 @@ This analytic will detect a suspicious process that modify a registry related to -#### Search +#### Search ``` @@ -114,7 +114,8 @@ This analytic will detect a suspicious process that modify a registry related to The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_defender_exclusion_registry_entry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_defender_exclusion_registry_entry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ admin or user may choose to use this windows features. | 64.0 | 80 | 80 | exclusion registry $registry_path$ modified or added on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html](https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html) diff --git a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md index 75ef2acbae..404c6dbede 100644 --- a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md +++ b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md @@ -89,7 +89,7 @@ This analytic identifies commonly used command-line arguments used by `rclone.ex -#### Search +#### Search ``` @@ -103,10 +103,11 @@ This analytic identifies commonly used command-line arguments used by `rclone.ex #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_rclone](https://github.com/splunk/security_content/blob/develop/macros/process_rclone.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rclone](https://github.com/splunk/security_content/blob/develop/macros/process_rclone.yml) -Note that **detect_rclone_command-line_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_rclone_command-line_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +141,9 @@ False positives should be limited as this is restricted to the Rclone process na | 35.0 | 50 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to connect to a remote cloud service to move files or folders. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://redcanary.com/blog/rclone-mega-extortion/](https://redcanary.com/blog/rclone-mega-extortion/) diff --git a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md index 2a3aac4a6f..289446a6ed 100644 --- a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md +++ b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md @@ -122,7 +122,7 @@ The following analytic assists with identifying a PowerShell process spawned as -#### Search +#### Search ``` @@ -138,7 +138,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **possible_lateral_movement_powershell_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **possible_lateral_movement_powershell_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -176,6 +177,9 @@ Legitimate applications may spawn PowerShell as a child process of the the ident | 45.0 | 90 | 50 | A PowerShell process was spawned as a child process of typically abused processes on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1021/003](https://attack.mitre.org/techniques/T1021/003) diff --git a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md index 045b3529ef..88b4085dff 100644 --- a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md +++ b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md @@ -22,7 +22,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -99,7 +99,7 @@ The following hunting analytic leverages Event ID 4698, `A scheduled task was cr -#### Search +#### Search ``` `wineventlog_security` EventCode=4698 @@ -114,7 +114,8 @@ The following hunting analytic leverages Event ID 4698, `A scheduled task was cr The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **randomly_generated_scheduled_task_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **randomly_generated_scheduled_task_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ Legitimate applications may use random Scheduled Task names. | 45.0 | 90 | 50 | A windows scheduled task with a suspicious task name was created on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1053/005/](https://attack.mitre.org/techniques/T1053/005/) diff --git a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md index 1b1c3826a9..871bb5653a 100644 --- a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md +++ b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md @@ -20,7 +20,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -97,7 +97,7 @@ The following hunting analytic leverages Event ID 7045, `A new service was insta -#### Search +#### Search ``` `wineventlog_system` EventCode=7045 @@ -111,7 +111,8 @@ The following hunting analytic leverages Event ID 7045, `A new service was insta The SPL above uses the following Macros: * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) -Note that **randomly_generated_windows_service_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **randomly_generated_windows_service_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ Legitimate applications may use random Windows Service names. | 45.0 | 90 | 50 | A Windows Service with a suspicious service name was installed on $ComputerName$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1543/003/](https://attack.mitre.org/techniques/T1543/003/) diff --git a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md index 930626cc08..bbfc479e6d 100644 --- a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md +++ b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md @@ -18,7 +18,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -94,7 +94,7 @@ The detection calculates the standard deviation for each host and leverages the -#### Search +#### Search ``` `wineventlog_security` EventCode=4769 Service_Name="*$" Account_Name!="*$*" @@ -110,7 +110,8 @@ The detection calculates the standard deviation for each host and leverages the The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **unusual_number_of_computer_service_tickets_requested_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **unusual_number_of_computer_service_tickets_requested_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ An single endpoint requesting a large number of computer service tickets is not | 42.0 | 70 | 60 | | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1078/](https://attack.mitre.org/techniques/T1078/) diff --git a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md index ec64a1e108..922399b209 100644 --- a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md +++ b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md @@ -18,7 +18,7 @@ tags: - Splunk Cloud --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -94,7 +94,7 @@ The detection calculates the standard deviation for each host and leverages the -#### Search +#### Search ``` `wineventlog_security` EventCode=4624 Logon_Type=3 Account_Name!="*$" @@ -111,7 +111,8 @@ The detection calculates the standard deviation for each host and leverages the The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **unusual_number_of_remote_endpoint_authentication_events_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **unusual_number_of_remote_endpoint_authentication_events_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ An single endpoint authenticating to a large number of hosts is not common behav | 42.0 | 70 | 60 | | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1078/](https://attack.mitre.org/techniques/T1078/) diff --git a/docs/_posts/2021-12-03-short_lived_scheduled_task.md b/docs/_posts/2021-12-03-short_lived_scheduled_task.md index f463a4671a..718944ddf8 100644 --- a/docs/_posts/2021-12-03-short_lived_scheduled_task.md +++ b/docs/_posts/2021-12-03-short_lived_scheduled_task.md @@ -90,7 +90,7 @@ The following analytic leverages Windows Security EventCode 4698, `A scheduled t -#### Search +#### Search ``` `wineventlog_security` EventCode=4698 OR EventCode=4699 @@ -106,7 +106,8 @@ The following analytic leverages Windows Security EventCode 4698, `A scheduled t The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **short_lived_scheduled_task_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **short_lived_scheduled_task_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ Although uncommon, legitimate applications may create and delete a Scheduled Tas | 81.0 | 90 | 90 | A windows scheduled task was created and deleted in 30 seconds on $ComputerName$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1053/005/](https://attack.mitre.org/techniques/T1053/005/) diff --git a/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md b/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md index eefe094840..6bf001f00d 100644 --- a/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md +++ b/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md @@ -90,7 +90,7 @@ The search logic specifically looks for high number of distinct commands run in -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **suspicious_linux_discovery_commands_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_linux_discovery_commands_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ Unless an administrator is using these commands to troubleshoot or audit a syste | 81.0 | 90 | 90 | Suspicious Linux Discovery Commands detected on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/matrices/enterprise/linux/](https://attack.mitre.org/matrices/enterprise/linux/) diff --git a/docs/_posts/2021-12-07-ms_exchange_mailbox_replication_service_writing_active_server_pages.md b/docs/_posts/2021-12-07-ms_exchange_mailbox_replication_service_writing_active_server_pages.md index 752bff1c36..cdac3522d6 100644 --- a/docs/_posts/2021-12-07-ms_exchange_mailbox_replication_service_writing_active_server_pages.md +++ b/docs/_posts/2021-12-07-ms_exchange_mailbox_replication_service_writing_active_server_pages.md @@ -22,7 +22,7 @@ tags: - Endpoint --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -101,7 +101,7 @@ The following query identifies suspicious .aspx created in 3 paths identified by -#### Search +#### Search ``` @@ -120,7 +120,8 @@ The following query identifies suspicious .aspx created in 3 paths identified by The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **ms_exchange_mailbox_replication_service_writing_active_server_pages_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **ms_exchange_mailbox_replication_service_writing_active_server_pages_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -156,6 +157,9 @@ The query is structured in a way that `action` (read, create) is not defined. Re | 81.0 | 90 | 90 | A file - $file_name$ was written to disk that is related to IIS exploitation related to ProxyShell. Review further file modifications on endpoint $dest$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://redcanary.com/blog/blackbyte-ransomware/](https://redcanary.com/blog/blackbyte-ransomware/) diff --git a/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md b/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md index dc02f1a68b..8110953841 100644 --- a/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md +++ b/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md @@ -89,7 +89,7 @@ The following analytic identifies the Raccine Rules Updater scheduled task being -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_raccine_scheduled_task_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_raccine_scheduled_task_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ False positives should be limited, however filter as needed. | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user user$ attempting to disable Raccines scheduled task. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://redcanary.com/blog/blackbyte-ransomware/](https://redcanary.com/blog/blackbyte-ransomware/) diff --git a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md index eff837297a..5c583f189b 100644 --- a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md +++ b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md @@ -107,7 +107,7 @@ In addition, `msi.dll` has been abused in DLL side-loading attacks by being load -#### Search +#### Search ``` `sysmon` EventCode=7 ImageLoaded="*\\msi.dll" NOT (Image IN ("*\\System32\\*","*\\syswow64\\*","*\\windows\\*", "*\\winsxs\\*")) @@ -122,7 +122,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **msi_module_loaded_by_non-system_binary_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **msi_module_loaded_by_non-system_binary_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -154,6 +155,9 @@ It is possible some Administrative utilities will load msi.dll outside of normal | 56.0 | 80 | 70 | The following module $ImageLoaded$ was loaded by $Image$ outside of the normal system paths on endpoint $Computer$, potentally related to DLL side-loading. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attackerkb.com/topics/7LstI2clmF/cve-2021-41379/rapid7-analysis](https://attackerkb.com/topics/7LstI2clmF/cve-2021-41379/rapid7-analysis) diff --git a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md index cdf9515aaa..afa6e97e98 100644 --- a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md +++ b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md @@ -94,7 +94,7 @@ The following analytic identifies the use of curl on Linux or MacOS attempting t -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **curl_download_and_bash_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **curl_download_and_bash_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ False positives should be limited, however filtering may be required. | 80.0 | 80 | 100 | An instance of $process_name$ was identified on endpoint $dest$ attempting to download a remote file and run it with bash. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java](https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java) diff --git a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md index eb8d79363f..1dd74c2641 100644 --- a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md +++ b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md @@ -94,7 +94,7 @@ The following analytic identifies the use of wget on Linux or MacOS attempting t -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **wget_download_and_bash_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **wget_download_and_bash_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ False positives should be limited, however filtering may be required. | 80.0 | 80 | 100 | An instance of $process_name$ was identified on endpoint $dest$ attempting to download a remote file and run it with bash. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java](https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java) diff --git a/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md b/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md index 5a5d2074d3..2739356c51 100644 --- a/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md +++ b/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md @@ -108,7 +108,7 @@ Malicious actors often abuse misconfigured LDAP servers or applications that use -#### Search +#### Search ``` @@ -124,7 +124,8 @@ Malicious actors often abuse misconfigured LDAP servers or applications that use The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **detect_outbound_ldap_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_outbound_ldap_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,6 +153,9 @@ Unknown at this moment. Outbound LDAP traffic should not be allowed outbound thr | 56.0 | 70 | 80 | An outbound LDAP connection from $src_ip$ in your infrastructure connecting to dest ip $dest_ip$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/](https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/) diff --git a/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md b/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md index 95c15ec2c8..40a8b78fce 100644 --- a/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md +++ b/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md @@ -94,7 +94,7 @@ The following analytic identifies a Java user agent performing a GET request for -#### Search +#### Search ``` @@ -109,7 +109,8 @@ The following analytic identifies a Java user agent performing a GET request for The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **java_class_file_download_by_java_user_agent_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **java_class_file_download_by_java_user_agent_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +141,9 @@ Filtering may be required in some instances, filter as needed. | 40.0 | 80 | 50 | A Java user agent $http_user_agent$ was performing a $http_method$ to retrieve a remote class file. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://arstechnica.com/information-technology/2021/12/as-log4shell-wreaks-havoc-payroll-service-reports-ransomware-attack/](https://arstechnica.com/information-technology/2021/12/as-log4shell-wreaks-havoc-payroll-service-reports-ransomware-attack/) diff --git a/docs/_posts/2021-12-13-linux_java_spawning_shell.md b/docs/_posts/2021-12-13-linux_java_spawning_shell.md index 537c458be9..57bea1b9ca 100644 --- a/docs/_posts/2021-12-13-linux_java_spawning_shell.md +++ b/docs/_posts/2021-12-13-linux_java_spawning_shell.md @@ -94,7 +94,7 @@ The following analytic identifies the process name of Java, Apache, or Tomcat sp -#### Search +#### Search ``` @@ -108,10 +108,11 @@ The following analytic identifies the process name of Java, Apache, or Tomcat sp #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [linux_shells](https://github.com/splunk/security_content/blob/develop/macros/linux_shells.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_java_spawning_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_java_spawning_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ Filtering may be required on internal developer build systems or classify assets | 40.0 | 80 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ spawning a Linux shell, potentially indicative of exploitation. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/](https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/) diff --git a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md index 394e00a8b0..f2b8046c80 100644 --- a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md +++ b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md @@ -101,7 +101,7 @@ CVE-2021-44228 Log4Shell payloads can be injected via various methods, but on of -#### Search +#### Search ``` @@ -119,7 +119,8 @@ CVE-2021-44228 Log4Shell payloads can be injected via various methods, but on of #### Macros The SPL above uses the following Macros: -Note that **log4shell_jndi_payload_injection_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **log4shell_jndi_payload_injection_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * action @@ -156,6 +157,9 @@ If there is a vulnerablility scannner looking for log4shells this will trigger, | 15.0 | 50 | 30 | CVE-2021-44228 Log4Shell triggered for host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.lunasec.io/docs/blog/log4j-zero-day/](https://www.lunasec.io/docs/blog/log4j-zero-day/) diff --git a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md index 9818207d9d..2489753379 100644 --- a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md +++ b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md @@ -101,7 +101,7 @@ CVE-2021-44228 Log4Shell payloads can be injected via various methods, but on of -#### Search +#### Search ``` @@ -127,7 +127,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **log4shell_jndi_payload_injection_with_outbound_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **log4shell_jndi_payload_injection_with_outbound_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * action @@ -164,6 +165,9 @@ If there is a vulnerablility scannner looking for log4shells this will trigger, | 15.0 | 50 | 30 | CVE-2021-44228 Log4Shell triggered for host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.lunasec.io/docs/blog/log4j-zero-day/](https://www.lunasec.io/docs/blog/log4j-zero-day/) diff --git a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md index 1b247ce26c..90e1ca92fc 100644 --- a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md +++ b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md @@ -93,7 +93,7 @@ A required step while exploiting the CVE-2021-44228-Log4j vulnerability is that -#### Search +#### Search ``` @@ -114,7 +114,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **outbound_network_connection_from_java_using_default_ports_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **outbound_network_connection_from_java_using_default_ports_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,6 +149,9 @@ Legitimate Java applications may use perform outbound connections to these ports | 54.0 | 90 | 60 | Java performed outbound connections to default ports of LDAP or RMI on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.lunasec.io/docs/blog/log4j-zero-day/](https://www.lunasec.io/docs/blog/log4j-zero-day/) diff --git a/docs/_posts/2021-12-13-windows_java_spawning_shells.md b/docs/_posts/2021-12-13-windows_java_spawning_shells.md index 7620550938..c5f723083c 100644 --- a/docs/_posts/2021-12-13-windows_java_spawning_shells.md +++ b/docs/_posts/2021-12-13-windows_java_spawning_shells.md @@ -17,7 +17,7 @@ tags: - Endpoint --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -96,7 +96,7 @@ The following analytic identifies the process name of java.exe and w3wp.exe spaw -#### Search +#### Search ``` @@ -110,10 +110,11 @@ The following analytic identifies the process name of java.exe and w3wp.exe spaw #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_java_spawning_shells_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_java_spawning_shells_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ Filtering may be required on internal developer build systems or classify assets | 40.0 | 80 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ spawning a Windows shell, potentially indicative of exploitation. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/](https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/) diff --git a/docs/_posts/2021-12-14-hunting_for_log4shell.md b/docs/_posts/2021-12-14-hunting_for_log4shell.md index 105f8f4794..8d27ed5fdf 100644 --- a/docs/_posts/2021-12-14-hunting_for_log4shell.md +++ b/docs/_posts/2021-12-14-hunting_for_log4shell.md @@ -104,7 +104,7 @@ Finally, a simple table is created to show the scoring and the _raw field. Sort -#### Search +#### Search ``` @@ -231,7 +231,8 @@ Finally, a simple table is created to show the scoring and the _raw field. Sort #### Macros The SPL above uses the following Macros: -Note that **hunting_for_log4shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **hunting_for_log4shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -263,6 +264,9 @@ It is highly possible you will find false positives, however, the base score is | 40.0 | 80 | 50 | Hunting for Log4Shell exploitation has occurred. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72](https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72) diff --git a/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md b/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md index c9c2860220..148bbcda60 100644 --- a/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md +++ b/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md @@ -104,7 +104,7 @@ The following analytic identifies a suspicious file creation in known cron table -#### Search +#### Search ``` @@ -120,7 +120,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_add_files_in_known_crontab_directories_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_add_files_in_known_crontab_directories_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ Administrator or network operator can create file in crontab folders for automat | 25.0 | 50 | 50 | a file $file_name$ is created in $file_path$ on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.sandflysecurity.com/blog/detecting-cronrat-malware-on-linux-instantly/](https://www.sandflysecurity.com/blog/detecting-cronrat-malware-on-linux-instantly/) diff --git a/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md b/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md index 1f38d64032..eb83562a6c 100644 --- a/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md +++ b/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md @@ -104,7 +104,7 @@ The following analytic identifies a suspicious file creation of /etc/at.allow or -#### Search +#### Search ``` @@ -120,7 +120,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_at_allow_config_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_at_allow_config_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ Administrator or network operator can create this file for automation purposes. | 25.0 | 50 | 50 | A file $file_name$ is created in $file_path$ on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://linuxize.com/post/at-command-in-linux/](https://linuxize.com/post/at-command-in-linux/) diff --git a/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md b/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md index b1a2016c6c..2ca39da257 100644 --- a/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md +++ b/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md @@ -104,7 +104,7 @@ The following analytic identifies a suspicious cronjobs modification using cront -#### Search +#### Search ``` @@ -120,7 +120,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_edit_cron_table_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_edit_cron_table_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ Administrator or network operator can use this application for automation purpos | 9.0 | 30 | 30 | A possible crontab edit command $process$ executed on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1053/003/](https://attack.mitre.org/techniques/T1053/003/) diff --git a/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md b/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md index dfa943d213..2cf6604f36 100644 --- a/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md +++ b/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md @@ -104,7 +104,7 @@ This analytic looks for possible suspicious commandline that may use to append a -#### Search +#### Search ``` @@ -120,7 +120,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ Administrator or network operator can use this commandline for automation purpos | 49.0 | 70 | 70 | A commandline $process$ that may modify cronjob file in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1053/003/](https://attack.mitre.org/techniques/T1053/003/) diff --git a/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md b/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md index 8a657ab633..15eaea4b60 100644 --- a/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md +++ b/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md @@ -104,7 +104,7 @@ This analytic looks for possible modification of cronjobs file using editor. Thi -#### Search +#### Search ``` @@ -120,7 +120,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_possible_cronjob_modification_with_editor_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_possible_cronjob_modification_with_editor_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ Administrator or network operator can use this commandline for automation purpos | 6.0 | 20 | 30 | A commandline $process$ that may modify cronjob file using editor in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1053/003/](https://attack.mitre.org/techniques/T1053/003/) diff --git a/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md b/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md index 4a9684b84a..c23441d92c 100644 --- a/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md +++ b/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md @@ -102,7 +102,7 @@ This analytic looks for suspicious file creation on init system directories for -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_file_creation_in_init_boot_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_file_creation_in_init_boot_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ Administrator or network operator can create file in this folders for automation | 49.0 | 70 | 70 | A file $file_name$ is created in $file_path$ on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/](https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/) diff --git a/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md b/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md index aaeb44a782..041d261d40 100644 --- a/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md +++ b/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md @@ -102,7 +102,7 @@ This analytic looks for suspicious file creation in /etc/profile.d directory to -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_file_creation_in_profile_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_file_creation_in_profile_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ Administrator or network operator can create file in profile.d folders for autom | 56.0 | 70 | 80 | A file $file_name$ is created in $file_path$ on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1546/004/](https://attack.mitre.org/techniques/T1546/004/) diff --git a/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md b/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md index 7e2ab465ec..3b3d0cf203 100644 --- a/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md +++ b/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md @@ -102,7 +102,7 @@ This analytic looks for suspicious command-lines that can be possibly used to mo -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_possible_append_command_to_profile_config_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_possible_append_command_to_profile_config_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ Administrator or network operator can use this commandline for automation purpos | 49.0 | 70 | 70 | a commandline $process$ that may modify profile files in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://unix.stackexchange.com/questions/129143/what-is-the-purpose-of-bashrc-and-how-does-it-work](https://unix.stackexchange.com/questions/129143/what-is-the-purpose-of-bashrc-and-how-does-it-work) diff --git a/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md b/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md index 7b49977e68..7ca13ac890 100644 --- a/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md +++ b/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md @@ -104,7 +104,7 @@ This analytic looks for suspicious file creation in systemd timer directory in l -#### Search +#### Search ``` @@ -120,7 +120,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_service_file_created_in_systemd_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_service_file_created_in_systemd_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ Administrator or network operator can create file in systemd folders for automat | 64.0 | 80 | 80 | A service file named as $file_path$ is created in systemd folder on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1053/006/](https://attack.mitre.org/techniques/T1053/006/) diff --git a/docs/_posts/2021-12-20-linux_service_restarted.md b/docs/_posts/2021-12-20-linux_service_restarted.md index 73a172b65a..175cd02418 100644 --- a/docs/_posts/2021-12-20-linux_service_restarted.md +++ b/docs/_posts/2021-12-20-linux_service_restarted.md @@ -104,7 +104,7 @@ This analytic looks for restarted or re-enable services in linux platform. This -#### Search +#### Search ``` @@ -120,7 +120,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_service_restarted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_service_restarted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ Administrator or network operator can use this commandline for automation purpos | 25.0 | 50 | 50 | A commandline $process$ that may create or start a service on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1543/003/](https://attack.mitre.org/techniques/T1543/003/) diff --git a/docs/_posts/2021-12-20-linux_service_started_or_enabled.md b/docs/_posts/2021-12-20-linux_service_started_or_enabled.md index 470d92da61..5c174d8f57 100644 --- a/docs/_posts/2021-12-20-linux_service_started_or_enabled.md +++ b/docs/_posts/2021-12-20-linux_service_started_or_enabled.md @@ -104,7 +104,7 @@ This analytic looks for created or enable services in linux platform. This techn -#### Search +#### Search ``` @@ -120,7 +120,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_service_started_or_enabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_service_started_or_enabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ Administrator or network operator can use this commandline for automation purpos | 42.0 | 60 | 70 | a commandline $process$ that may create or start a service on $dest | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1543/003/](https://attack.mitre.org/techniques/T1543/003/) diff --git a/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md b/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md index d82770f5c5..ad1384e32f 100644 --- a/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md +++ b/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md @@ -107,7 +107,7 @@ As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Im -#### Search +#### Search ``` `wineventlog_security` EventCode=4781 Old_Account_Name="*$" New_Account_Name!="*$" @@ -119,7 +119,8 @@ As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Im The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **suspicious_computer_account_name_change_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_computer_account_name_change_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ Renaming a computer account name to a name that not end with '$' is highly unsua | 70.0 | 100 | 70 | A computer account $Old_Account_Name$ was renamed with a suspicious computer name | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html](https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html) diff --git a/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md b/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md index 8628490bf4..ff008f918e 100644 --- a/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md +++ b/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md @@ -107,7 +107,7 @@ As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Im -#### Search +#### Search ``` `wineventlog_security` EventCode=4769 @@ -121,7 +121,8 @@ As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Im The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **suspicious_kerberos_service_ticket_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_kerberos_service_ticket_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,6 +153,9 @@ We have tested this detection logic with ~2 million 4769 events and did not iden | 60.0 | 100 | 60 | A suspicious Kerberos Service Ticket was requested by $Account_Name$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html](https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html) diff --git a/docs/_posts/2021-12-21-linux_add_user_account.md b/docs/_posts/2021-12-21-linux_add_user_account.md index c8b2ecec32..2d49daf112 100644 --- a/docs/_posts/2021-12-21-linux_add_user_account.md +++ b/docs/_posts/2021-12-21-linux_add_user_account.md @@ -100,7 +100,7 @@ This analytic looks for commands to create user accounts on the linux platform. -#### Search +#### Search ``` @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_add_user_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_add_user_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ Administrator or network operator can execute this command. Please update the fi | 25.0 | 50 | 50 | A commandline $process$ that may create user account on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/](https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/) diff --git a/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md b/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md index 7c46cc0c16..dee99ea4db 100644 --- a/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md +++ b/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md @@ -100,7 +100,7 @@ This analytic looks for a commandline that change the file owner to root using c -#### Search +#### Search ``` @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_change_file_owner_to_root_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_change_file_owner_to_root_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ Administrator or network operator can execute this command. Please update the fi | 64.0 | 80 | 80 | A commandline $process$ that may change ownership to root on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://unix.stackexchange.com/questions/101073/how-to-change-permissions-from-root-user-to-all-users](https://unix.stackexchange.com/questions/101073/how-to-change-permissions-from-root-user-to-all-users) diff --git a/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md b/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md index ac95657fc1..bea14acb38 100644 --- a/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md +++ b/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md @@ -102,7 +102,7 @@ This analytic is to look for suspicious command lines that may add entry to /etc -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_nopasswd_entry_in_sudoers_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_nopasswd_entry_in_sudoers_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ Administrator or network operator can execute this command. Please update the fi | 64.0 | 80 | 80 | a commandline $process$ executed on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands](https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands) diff --git a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md index dc4e81c2d9..49f2f21f83 100644 --- a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md +++ b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md @@ -102,7 +102,7 @@ This analytic looks for suspicious chmod utility execution to enable SUID bit. T -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_setuid_using_chmod_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_setuid_using_chmod_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ Administrator or network operator can execute this command. Please update the fi | 49.0 | 70 | 70 | a commandline $process$ that may set suid or sgid on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/](https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/) diff --git a/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md index 47a0d589d1..efbdb8126c 100644 --- a/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md +++ b/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md @@ -102,7 +102,7 @@ This analytic looks for suspicious setcap utility execution to enable SUID bit. -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_setuid_using_setcap_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_setuid_using_setcap_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ Administrator or network operator can execute this command. Please update the fi | 49.0 | 70 | 70 | A commandline $process$ that may set suid or sgid on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/](https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/) diff --git a/docs/_posts/2021-12-21-linux_visudo_utility_execution.md b/docs/_posts/2021-12-21-linux_visudo_utility_execution.md index f8f3b591d6..65714b0501 100644 --- a/docs/_posts/2021-12-21-linux_visudo_utility_execution.md +++ b/docs/_posts/2021-12-21-linux_visudo_utility_execution.md @@ -102,7 +102,7 @@ This analytic is to looks for suspicious commandline that add entry to /etc/sudo -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_visudo_utility_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_visudo_utility_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ Administrator or network operator can execute this command. Please update the fi | 16.0 | 40 | 40 | A commandline $process$ executed on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands](https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands) diff --git a/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md b/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md index d9e5aea24e..7bb042e971 100644 --- a/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md +++ b/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md @@ -100,7 +100,7 @@ As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Im -#### Search +#### Search ``` `wineventlog_security` (EventCode=4781 Old_Account_Name="*$" New_Account_Name!="*$") OR (EventCode=4768 Account_Name!="*$") @@ -116,7 +116,8 @@ As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Im The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **suspicious_ticket_granting_ticket_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_ticket_granting_ticket_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ A computer account name change event inmediately followed by a kerberos TGT requ | 60.0 | 100 | 60 | A suspicious TGT was requested was requested | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html](https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html) diff --git a/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md b/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md index 20ac3ca71b..cc14c79135 100644 --- a/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md +++ b/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md @@ -102,7 +102,7 @@ This analytic looks for suspicious file creation in kernel/driver directory in l -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_file_created_in_kernel_driver_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_file_created_in_kernel_driver_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ Administrator or network operator can create file in this folders for automation | 72.0 | 80 | 90 | A file $file_name$ is created in $file_path$ on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/](https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/) diff --git a/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md b/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md index 5fbd7d9e23..e174e88705 100644 --- a/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md +++ b/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md @@ -102,7 +102,7 @@ This analytic looks for inserting of linux kernel module using insmod utility fu -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_insert_kernel_module_using_insmod_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_insert_kernel_module_using_insmod_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ Administrator or network operator can execute this command. Please update the fi | 64.0 | 80 | 80 | A commandline $process$ that may install kernel module on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/](https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/) diff --git a/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md b/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md index d77a35735e..42f442785c 100644 --- a/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md +++ b/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md @@ -102,7 +102,7 @@ This analytic looks for possible installing a linux kernel module using modprobe -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_install_kernel_module_using_modprobe_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_install_kernel_module_using_modprobe_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ Administrator or network operator can execute this command. Please update the fi | 64.0 | 80 | 80 | A commandline $process$ that may install kernel module on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/](https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/) diff --git a/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md b/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md index dfbd0f5d2e..f338bfbad4 100644 --- a/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md +++ b/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md @@ -104,7 +104,7 @@ This analytic is to detect a suspicious command that may hijack a library functi -#### Search +#### Search ``` @@ -120,7 +120,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_preload_hijack_library_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_preload_hijack_library_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ Administrator or network operator can execute this command. Please update the fi | 64.0 | 80 | 80 | A commandline $process$ that may hijack library function on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://compilepeace.medium.com/memory-malware-part-0x2-writing-userland-rootkits-via-ld-preload-30121c8343d5](https://compilepeace.medium.com/memory-malware-part-0x2-writing-userland-rootkits-via-ld-preload-30121c8343d5) diff --git a/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md b/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md index 92eafb8fa3..58e79c9c2a 100644 --- a/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md +++ b/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md @@ -102,7 +102,7 @@ This analytic is to look for possible elevation control access using a common kn -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_common_process_for_elevation_control_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_common_process_for_elevation_control_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ Administrator or network operator can execute this command. Please update the fi | 9.0 | 30 | 30 | A commandline $process$ with process $process_name$ on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1548/001/](https://attack.mitre.org/techniques/T1548/001/) diff --git a/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md b/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md index b34c4ad25a..30db9c35f1 100644 --- a/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md +++ b/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md @@ -102,7 +102,7 @@ This analytic is to looks for file creation of sudoers.tmp file cause by editing -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_sudoers_tmp_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_sudoers_tmp_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ administrator or network operator can execute this command. Please update the fi | 72.0 | 80 | 90 | A file $file_name$ is created in $file_path$ on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://forum.ubuntuusers.de/topic/sudo-visudo-gibt-etc-sudoers-tmp/](https://forum.ubuntuusers.de/topic/sudo-visudo-gibt-etc-sudoers-tmp/) diff --git a/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md b/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md index 416fecad62..1d490859e9 100644 --- a/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md +++ b/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md @@ -102,7 +102,7 @@ This analytic is to detect the execution of sudo or su command in linux operatin -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_sudo_or_su_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_sudo_or_su_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ Administrator or network operator can execute this command. Please update the fi | 9.0 | 30 | 30 | A commandline $process$ that execute sudo or su in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1548/003/](https://attack.mitre.org/techniques/T1548/003/) diff --git a/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md b/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md index 150a324733..8935470913 100644 --- a/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md +++ b/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md @@ -102,7 +102,7 @@ This analytic is to detect the creation of doas.conf file in linux host platform -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_doas_conf_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_doas_conf_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ Administrator or network operator can execute this command. Please update the fi | 49.0 | 70 | 70 | A file $file_name$ is created in $file_path$ on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://wiki.gentoo.org/wiki/Doas](https://wiki.gentoo.org/wiki/Doas) diff --git a/docs/_posts/2022-01-05-linux_doas_tool_execution.md b/docs/_posts/2022-01-05-linux_doas_tool_execution.md index c7d41a8375..421bcf2b78 100644 --- a/docs/_posts/2022-01-05-linux_doas_tool_execution.md +++ b/docs/_posts/2022-01-05-linux_doas_tool_execution.md @@ -102,7 +102,7 @@ This analytic is to detect the doas tool execution in linux host platform. This -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_doas_tool_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_doas_tool_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ Administrator or network operator can execute this command. Please update the fi | 49.0 | 70 | 70 | A doas $process_name$ with commandline $process$ was executed on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://wiki.gentoo.org/wiki/Doas](https://wiki.gentoo.org/wiki/Doas) diff --git a/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md b/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md index c7b6f89d49..e2a7710804 100644 --- a/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md +++ b/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md @@ -100,7 +100,7 @@ This analytic is to detect a possible attempt to dump or access the content of / -#### Search +#### Search ``` @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_possible_access_to_credential_files_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_possible_access_to_credential_files_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ Administrator or network operator can execute this command. Please update the fi | 25.0 | 50 | 50 | A commandline $process$ executed on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://askubuntu.com/questions/445361/what-is-difference-between-etc-shadow-and-etc-passwd](https://askubuntu.com/questions/445361/what-is-difference-between-etc-shadow-and-etc-passwd) diff --git a/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md b/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md index 20cd409058..92418065c4 100644 --- a/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md +++ b/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md @@ -102,7 +102,7 @@ This analytic is to detect a possible access or modification of /etc/sudoers fil -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_possible_access_to_sudoers_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_possible_access_to_sudoers_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ administrator or network operator can execute this command. Please update the fi | 25.0 | 50 | 50 | A commandline $process$ executed on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1548/003/](https://attack.mitre.org/techniques/T1548/003/) diff --git a/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md b/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md index 2b56cb3b82..ffb1e0fbe4 100644 --- a/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md +++ b/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md @@ -100,7 +100,7 @@ This analytic is to look for suspicious process command-line that might be acces -#### Search +#### Search ``` @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_possible_access_or_modification_of_sshd_config_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_possible_access_or_modification_of_sshd_config_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ Administrator or network operator can use this commandline for automation purpos | 25.0 | 50 | 50 | a commandline $process$ executed on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.hackingarticles.in/ssh-penetration-testing-port-22/](https://www.hackingarticles.in/ssh-penetration-testing-port-22/) diff --git a/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md b/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md index 5cbbc014e6..f6b1140b8a 100644 --- a/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md +++ b/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md @@ -100,7 +100,7 @@ This analytic is to look for possible ssh key file creation on ~/.ssh/ folder. T -#### Search +#### Search ``` @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_possible_ssh_key_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_possible_ssh_key_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ Administrator or network operator can create file in ~/.ssh folders for automati | 36.0 | 60 | 60 | A file $file_name$ is created in $file_path$ on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.hackingarticles.in/ssh-penetration-testing-port-22/](https://www.hackingarticles.in/ssh-penetration-testing-port-22/) diff --git a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md index a778124702..be29f9c83d 100644 --- a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md +++ b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md @@ -108,7 +108,7 @@ The following hunting analytic identifies PowerShell commands utilizing the Wind -#### Search +#### Search ``` @@ -130,7 +130,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -Note that **powershell_-_connect_to_internet_with_hidden_window_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **powershell_-_connect_to_internet_with_hidden_window_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -164,6 +165,9 @@ Legitimate process can have this combination of command-line options, but it's n | 81.0 | 90 | 90 | PowerShell processes $process$ started with parameters to modify the execution policy of the run, run in a hidden window, and connect to the Internet on host $dest$ executed by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://regexr.com/663rr](https://regexr.com/663rr) diff --git a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md index 42e1d69669..9839b5f4b0 100644 --- a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md +++ b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md @@ -96,7 +96,7 @@ The following hunting analytic identifies all processes requesting access into L -#### Search +#### Search ``` `sysmon` EventCode=10 TargetImage=*lsass.exe @@ -112,7 +112,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **windows_hunting_system_account_targeting_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_hunting_system_account_targeting_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ False positives will occur based on GrantedAccess and SourceUser, filter based o | 64.0 | 80 | 80 | A process, $SourceImage$, has loaded $ImageLoaded$ that are typically related to credential dumping on $dest$. Review for further details. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service](https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service) diff --git a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md index a669b3d1d1..0e7bec302f 100644 --- a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md +++ b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md @@ -96,7 +96,7 @@ The following analytic identifies non SYSTEM accounts requesting access to lsass -#### Search +#### Search ``` `sysmon` EventCode=10 TargetImage=*lsass.exe SourceUser!="NT AUTHORITY\\*" @@ -112,7 +112,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **windows_non-system_account_targeting_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_non-system_account_targeting_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ False positives will occur based on legitimate application requests, filter base | 64.0 | 80 | 80 | A process, $SourceImage$, has loaded $ImageLoaded$ that are typically related to credential dumping on $dest$. Review for further details. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service](https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service) diff --git a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md index f2101a570c..500a68f3d6 100644 --- a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md +++ b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md @@ -89,7 +89,7 @@ The following analytic uses a pretrained machine learning text classifier to det -#### Search +#### Search ``` @@ -109,10 +109,11 @@ The following analytic uses a pretrained machine learning text classifier to det #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [potentially_malicious_code_on_cmdline_tokenize_score](https://github.com/splunk/security_content/blob/develop/macros/potentially_malicious_code_on_cmdline_tokenize_score.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [potentially_malicious_code_on_cmdline_tokenize_score](https://github.com/splunk/security_content/blob/develop/macros/potentially_malicious_code_on_cmdline_tokenize_score.yml) -Note that **potentially_malicious_code_on_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **potentially_malicious_code_on_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ This model is an anomaly detector that identifies usage of APIs and scripting co | 12.0 | 60 | 20 | Unusual command-line execution with hallmarks of malicious activity run by $user$ found on $dest$ with commandline $process$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1059/003/](https://attack.mitre.org/techniques/T1059/003/) diff --git a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md index 196cd26a3f..ee82f4dd90 100644 --- a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md +++ b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md @@ -99,7 +99,7 @@ The following analytic identifies command-line arguments where `cmd.exe /c` is u -#### Search +#### Search ``` @@ -112,11 +112,12 @@ The following analytic identifies command-line arguments where `cmd.exe /c` is u #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -Note that **cmd_carry_out_string_command_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **cmd_carry_out_string_command_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -155,6 +156,9 @@ False positives may be high based on legitimate scripted code in any environment | 30.0 | 60 | 50 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting spawn a new process. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/) diff --git a/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md b/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md index 42139fe5ee..a3e2fd6605 100644 --- a/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md +++ b/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md @@ -110,7 +110,7 @@ This analytic looks for the presence of suspicious commandline parameters typica -#### Search +#### Search ``` @@ -126,7 +126,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **impacket_lateral_movement_commandline_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **impacket_lateral_movement_commandline_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -164,6 +165,9 @@ Although uncommon, Administrators may leverage Impackets tools to start a proces | 63.0 | 90 | 70 | Suspicious command line parameters on $dest may represent a lateral movement attack with Impackets tools | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1021/002/](https://attack.mitre.org/techniques/T1021/002/) diff --git a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md index 9730564c59..c20ab4e6f5 100644 --- a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md +++ b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md @@ -101,7 +101,7 @@ Alternatively, may use regex per matching here https://regexr.com/662ov. -#### Search +#### Search ``` @@ -123,7 +123,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -Note that **malicious_powershell_process_-_encoded_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **malicious_powershell_process_-_encoded_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -157,6 +158,9 @@ System administrators may use this option, but it's not common. | 35.0 | 70 | 50 | Powershell.exe running potentially malicious encodede commands on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://regexr.com/662ov](https://regexr.com/662ov) diff --git a/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md b/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md index 65cf4ce984..12873a5171 100644 --- a/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md +++ b/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md @@ -100,7 +100,7 @@ This analytic will identify a suspicious PowerShell command used to delete the W -#### Search +#### Search ``` `powershell` EventCode=4104 Message = "*rmdir *" AND Message = "*\\Microsoft\\Windows Defender*" @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **powershell_remove_windows_defender_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **powershell_remove_windows_defender_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ unknown | 90.0 | 100 | 90 | suspicious powershell script $Message$ was executed on the $ComputerName$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/](https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/) diff --git a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md index b453f77154..7e351060dc 100644 --- a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md +++ b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md @@ -94,7 +94,7 @@ This analytic detects a suspicious process making a DNS query via known, abused -#### Search +#### Search ``` `sysmon` EventCode=22 QueryName IN ("*pastebin*", "*discord*", "*telegram*", "*t.me*") process_name IN ("cmd.exe", "*powershell*", "pwsh.exe", "wscript.exe", "cscript.exe") @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **suspicious_process_dns_query_known_abuse_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_process_dns_query_known_abuse_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ Noise and false positive can be seen if the following instant messaging is allow | 64.0 | 80 | 80 | suspicious process $process_name$ has a dns query in $QueryName$ on $Computer$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://urlhaus.abuse.ch/url/1798923/](https://urlhaus.abuse.ch/url/1798923/) diff --git a/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md b/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md index c2b20b4b7b..31abbed1eb 100644 --- a/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md +++ b/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md @@ -100,7 +100,7 @@ This analytic identifies a process making a DNS query to Discord, a well known i -#### Search +#### Search ``` `sysmon` EventCode=22 QueryName IN ("*discord*") process_path != "*\\AppData\\Local\\Discord\\*" AND process_path != "*\\Program Files*" AND process_name != "discord.exe" @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **suspicious_process_with_discord_dns_query_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_process_with_discord_dns_query_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ Noise and false positive can be seen if the following instant messaging is allow | 64.0 | 80 | 80 | suspicious process $process_name$ has a dns query in $QueryName$ on $Computer$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/](https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/) diff --git a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md index e0de683120..b3ad1dae14 100644 --- a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md +++ b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md @@ -2,7 +2,7 @@ title: "Windows DotNet Binary in Non Standard Path" excerpt: "Masquerading , Rename System Utilities -, Signed Binary Proxy Execution +, System Binary Proxy Execution , InstallUtil " categories: @@ -13,7 +13,7 @@ toc_label: "" tags: - Masquerading - Rename System Utilities - - Signed Binary Proxy Execution + - System Binary Proxy Execution - InstallUtil - Defense Evasion - Defense Evasion @@ -55,7 +55,7 @@ The following analytic identifies native .net binaries within the Windows operat | [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.004](https://attack.mitre.org/techniques/T1218/004/) | InstallUtil | Defense Evasion | @@ -104,7 +104,7 @@ The following analytic identifies native .net binaries within the Windows operat -#### Search +#### Search ``` @@ -122,7 +122,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [is_net_windows_file](https://github.com/splunk/security_content/blob/develop/macros/is_net_windows_file.yml) -Note that **windows_dotnet_binary_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_dotnet_binary_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -162,6 +163,9 @@ False positives may be present and filtering may be required. Certain utilities | 49.0 | 70 | 70 | An instance of $parent_process_name$ spawning $process_name$ from a non-standard path was identified on endpoint $dest$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml) diff --git a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md index 380f1f2b8d..c9146ffb25 100644 --- a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md +++ b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md @@ -2,7 +2,7 @@ title: "Windows InstallUtil in Non Standard Path" excerpt: "Masquerading , Rename System Utilities -, Signed Binary Proxy Execution +, System Binary Proxy Execution , InstallUtil " categories: @@ -13,7 +13,7 @@ toc_label: "" tags: - Masquerading - Rename System Utilities - - Signed Binary Proxy Execution + - System Binary Proxy Execution - InstallUtil - Defense Evasion - Defense Evasion @@ -55,7 +55,7 @@ The following analytic identifies the Windows binary InstallUtil.exe running fro | [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.004](https://attack.mitre.org/techniques/T1218/004/) | InstallUtil | Defense Evasion | @@ -104,7 +104,7 @@ The following analytic identifies the Windows binary InstallUtil.exe running fro -#### Search +#### Search ``` @@ -117,11 +117,12 @@ The following analytic identifies the Windows binary InstallUtil.exe running fro #### Macros The SPL above uses the following Macros: -* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) -Note that **windows_installutil_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_installutil_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -162,6 +163,9 @@ False positives may be present and filtering may be required. Certain utilities | 49.0 | 70 | 70 | An instance of $parent_process_name$ spawning $process_name$ from a non-standard path was identified on endpoint $dest$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml) diff --git a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md index 9b35ad7848..954e5ee56b 100644 --- a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md +++ b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md @@ -95,7 +95,7 @@ This analytic will identify excessive file deletion events in the Windows Defend -#### Search +#### Search ``` `sysmon` EventCode=23 TargetFilename = "*\\ProgramData\\Microsoft\\Windows Defender*" @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **excessive_file_deletion_in_windefender_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **excessive_file_deletion_in_windefender_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ Windows Defender AV updates may cause this alert. Please update the filter macro | 25.0 | 50 | 50 | High frequency file deletion activity detected on host $Computer$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/](https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/) diff --git a/docs/_posts/2022-01-20-ping_sleep_batch_command.md b/docs/_posts/2022-01-20-ping_sleep_batch_command.md index 7f3c550dea..a139f4e8c3 100644 --- a/docs/_posts/2022-01-20-ping_sleep_batch_command.md +++ b/docs/_posts/2022-01-20-ping_sleep_batch_command.md @@ -102,7 +102,7 @@ This analytic will identify the possible execution of ping sleep batch commands. -#### Search +#### Search ``` @@ -116,10 +116,11 @@ This analytic will identify the possible execution of ping sleep batch commands. #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_ping](https://github.com/splunk/security_content/blob/develop/macros/process_ping.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_ping](https://github.com/splunk/security_content/blob/develop/macros/process_ping.yml) -Note that **ping_sleep_batch_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **ping_sleep_batch_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -155,6 +156,9 @@ Administrator or network operator may execute this command. Please update the fi | 36.0 | 60 | 60 | suspicious $process$ commandline run in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/](https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/) diff --git a/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md b/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md index 9bf9e7c0c0..b4b4ea67b5 100644 --- a/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md +++ b/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md @@ -89,7 +89,7 @@ The following analytic identifies the use of AdvancedRun.exe. AdvancedRun.exe ha -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_nirsoft_advancedrun_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_nirsoft_advancedrun_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ False positives should be limited as it is specific to AdvancedRun. Filter as ne | 60.0 | 60 | 100 | An instance of advancedrun.exe, $process_name$, was spawned by $parent_process_name$ on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [http://www.nirsoft.net/utils/advanced_run.html](http://www.nirsoft.net/utils/advanced_run.html) diff --git a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md index a1b58a5dec..f75eec4c30 100644 --- a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md +++ b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md @@ -89,7 +89,7 @@ The following hunting analytic assists with identifying the proces execution of -#### Search +#### Search ``` @@ -103,11 +103,12 @@ The following hunting analytic assists with identifying the proces execution of #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [is_nirsoft_software](https://github.com/splunk/security_content/blob/develop/macros/is_nirsoft_software.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_nirsoft_utilities_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_nirsoft_utilities_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ False positives may be present. Filtering may be required before setting to aler | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ related to NiRSoft software usage. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.cisa.gov/uscert/ncas/alerts/TA18-201A](https://www.cisa.gov/uscert/ncas/alerts/TA18-201A) diff --git a/docs/_posts/2022-01-26-active_setup_registry_autostart.md b/docs/_posts/2022-01-26-active_setup_registry_autostart.md index 085e69db10..e78367bbfe 100644 --- a/docs/_posts/2022-01-26-active_setup_registry_autostart.md +++ b/docs/_posts/2022-01-26-active_setup_registry_autostart.md @@ -96,7 +96,7 @@ This analytic is to detect a suspicious modification of the active setup registr -#### Search +#### Search ``` @@ -116,7 +116,8 @@ This analytic is to detect a suspicious modification of the active setup registr The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **active_setup_registry_autostart_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **active_setup_registry_autostart_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,6 +149,9 @@ Active setup installer may add or modify this registry. | 64.0 | 80 | 80 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3aWin32%2fPoisonivy.E](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3aWin32%2fPoisonivy.E) diff --git a/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md b/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md index f7022c398d..d95d5994ed 100644 --- a/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md +++ b/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md @@ -94,7 +94,7 @@ this search is to detect a suspicious registry modification to implement auto ad -#### Search +#### Search ``` @@ -114,7 +114,8 @@ this search is to detect a suspicious registry modification to implement auto ad The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **add_defaultuser_and_password_in_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **add_defaultuser_and_password_in_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ unknown | 25.0 | 50 | 50 | modified registry key $registry_key_name$ with registry value $registry_value_name$ to prepare autoadminlogon | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/](https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/) diff --git a/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md b/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md index 89888e22c8..d6290c8142 100644 --- a/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md +++ b/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md @@ -94,7 +94,7 @@ This analytic detects a potential suspicious modification of firewall rule regis -#### Search +#### Search ``` @@ -121,7 +121,8 @@ This analytic detects a potential suspicious modification of firewall rule regis The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **allow_inbound_traffic_by_firewall_rule_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **allow_inbound_traffic_by_firewall_rule_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,6 +153,9 @@ network admin may add/remove/modify public inbound firewall rule that may cause | 3.0 | 10 | 30 | Suspicious firewall modifications were detected via the registry on endpoint $dest$ by user $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps](https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps) diff --git a/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md b/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md index e042dba54b..3e3d8e950b 100644 --- a/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md +++ b/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md @@ -90,7 +90,7 @@ This analytic identifies a potential privilege escalation attempt to perform mal -#### Search +#### Search ``` @@ -110,7 +110,8 @@ This analytic identifies a potential privilege escalation attempt to perform mal The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **allow_operation_with_consent_admin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **allow_operation_with_consent_admin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +141,9 @@ unknown | 25.0 | 50 | 50 | Suspicious registry modification was performed on endpoint $dest$ by user $user$. This behavior is indicative of privilege escalation. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/341747f5-6b5d-4d30-85fc-fa1cc04038d4](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/341747f5-6b5d-4d30-85fc-fa1cc04038d4) diff --git a/docs/_posts/2022-01-26-disable_amsi_through_registry.md b/docs/_posts/2022-01-26-disable_amsi_through_registry.md index b558160c14..7d321ec83c 100644 --- a/docs/_posts/2022-01-26-disable_amsi_through_registry.md +++ b/docs/_posts/2022-01-26-disable_amsi_through_registry.md @@ -94,7 +94,7 @@ this search is to identify modification in registry to disable AMSI windows feat -#### Search +#### Search ``` @@ -114,7 +114,8 @@ this search is to identify modification in registry to disable AMSI windows feat The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **disable_amsi_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disable_amsi_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ network operator may disable this feature of windows but not so common. | 25.0 | 50 | 50 | Disable AMSI Through Registry | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://blog.f-secure.com/hunting-for-amsi-bypasses/](https://blog.f-secure.com/hunting-for-amsi-bypasses/) diff --git a/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md b/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md index 0d86c6e480..86bd7cffc0 100644 --- a/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md +++ b/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md @@ -94,7 +94,7 @@ This particular behavior is typically executed when an adversaries or malware ga -#### Search +#### Search ``` @@ -114,7 +114,8 @@ This particular behavior is typically executed when an adversaries or malware ga The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **disable_defender_antivirus_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disable_defender_antivirus_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ admin or user may choose to disable windows defender product | 49.0 | 70 | 70 | modified/added/deleted registry entry $registry_path$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/) diff --git a/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md b/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md index b59e41f180..80f501ec51 100644 --- a/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md +++ b/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md @@ -94,7 +94,7 @@ This analytic is to detect a suspicious modification of registry to disable wind -#### Search +#### Search ``` @@ -114,7 +114,8 @@ This analytic is to detect a suspicious modification of registry to disable wind The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **disable_defender_blockatfirstseen_feature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disable_defender_blockatfirstseen_feature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ admin or user may choose to disable windows defender product | 49.0 | 70 | 70 | modified/added/deleted registry entry $registry_path$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/) diff --git a/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md b/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md index 46065e094b..c5b2b218ef 100644 --- a/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md +++ b/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md @@ -94,7 +94,7 @@ This analytic is to detect a suspicious modification of registry to disable wind -#### Search +#### Search ``` @@ -114,7 +114,8 @@ This analytic is to detect a suspicious modification of registry to disable wind The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **disable_defender_enhanced_notification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disable_defender_enhanced_notification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ user may choose to disable windows defender AV | 49.0 | 70 | 70 | modified/added/deleted registry entry $registry_path$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/) diff --git a/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md b/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md index 5df3caff98..d41b3e0179 100644 --- a/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md +++ b/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md @@ -94,7 +94,7 @@ This particular behavior is typically executed when an adversaries or malware ga -#### Search +#### Search ``` @@ -114,7 +114,8 @@ This particular behavior is typically executed when an adversaries or malware ga The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **disable_defender_mpengine_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disable_defender_mpengine_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ admin or user may choose to disable windows defender product | 49.0 | 70 | 70 | modified/added/deleted registry entry $registry_path$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/) diff --git a/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md b/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md index 834fe3d956..c82531b9d7 100644 --- a/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md +++ b/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md @@ -94,7 +94,7 @@ This analytic is to detect a suspicious modification of registry to disable wind -#### Search +#### Search ``` @@ -114,7 +114,8 @@ This analytic is to detect a suspicious modification of registry to disable wind The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **disable_defender_spynet_reporting_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disable_defender_spynet_reporting_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ admin or user may choose to disable windows defender product | 49.0 | 70 | 70 | modified/added/deleted registry entry $registry_path$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/) diff --git a/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md b/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md index 2b0d4b1005..5cd596c82c 100644 --- a/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md +++ b/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md @@ -94,7 +94,7 @@ his analytic is to detect a suspicious modification of registry to disable windo -#### Search +#### Search ``` @@ -114,7 +114,8 @@ his analytic is to detect a suspicious modification of registry to disable windo The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **disable_defender_submit_samples_consent_feature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disable_defender_submit_samples_consent_feature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ admin or user may choose to disable windows defender product | 49.0 | 70 | 70 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/) diff --git a/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md b/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md index ad2a88e8df..c9bdd0e747 100644 --- a/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md +++ b/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md @@ -106,7 +106,7 @@ This correlation find exploitation of Log4Shell CVE-2021-44228 against systems u -#### Search +#### Search ``` @@ -124,7 +124,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **log4shell_cve-2021-44228_exploitation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **log4shell_cve-2021-44228_exploitation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -154,6 +155,9 @@ There are no known false positive for this search, but it could contain false po | 63.0 | 90 | 70 | Log4Shell Exploitation detected against $affected_systems$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://research.splunk.com/stories/log4shell_cve-2021-44228/](https://research.splunk.com/stories/log4shell_cve-2021-44228/) diff --git a/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md b/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md index 6163b0bc46..4342c653dc 100644 --- a/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md +++ b/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md @@ -102,7 +102,7 @@ The search looks for modifications to registry keys that can be used to launch a -#### Search +#### Search ``` @@ -122,7 +122,8 @@ The search looks for modifications to registry keys that can be used to launch a The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **registry_keys_used_for_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **registry_keys_used_for_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -160,6 +161,9 @@ There are many legitimate applications that must execute on system startup and w | 76.0 | 80 | 95 | A registry activity in $registry_path$ related to persistence in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md b/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md index 7682995088..25f3c092e4 100644 --- a/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md +++ b/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md @@ -100,7 +100,7 @@ This search looks for modifications to registry keys that can be used to elevate -#### Search +#### Search ``` @@ -120,7 +120,8 @@ This search looks for modifications to registry keys that can be used to elevate The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **registry_keys_used_for_privilege_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **registry_keys_used_for_privilege_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ There are many legitimate applications that must execute upon system startup and | 76.0 | 80 | 95 | A registry activity in $registry_path$ related to privilege escalation in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://blog.malwarebytes.com/101/2015/12/an-introduction-to-image-file-execution-options/](https://blog.malwarebytes.com/101/2015/12/an-introduction-to-image-file-execution-options/) diff --git a/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md b/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md index 9a9e5e33db..7d2703535d 100644 --- a/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md +++ b/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md @@ -89,7 +89,7 @@ This search detects registry key license at host where Remcos RAT agent is insta -#### Search +#### Search ``` @@ -109,7 +109,8 @@ This search detects registry key license at host where Remcos RAT agent is insta The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **remcos_client_registry_install_entry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **remcos_client_registry_install_entry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +141,9 @@ unknown | 90.0 | 90 | 100 | A registry entry $registry_path$ with registry keyname $registry_key_name$ related to Remcos RAT in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/software/S0332/](https://attack.mitre.org/software/S0332/) diff --git a/docs/_posts/2022-01-26-time_provider_persistence_registry.md b/docs/_posts/2022-01-26-time_provider_persistence_registry.md index c2220555d0..b83a0c9bd9 100644 --- a/docs/_posts/2022-01-26-time_provider_persistence_registry.md +++ b/docs/_posts/2022-01-26-time_provider_persistence_registry.md @@ -96,7 +96,7 @@ This analytic is to detect a suspicious modification of time provider registry f -#### Search +#### Search ``` @@ -116,7 +116,8 @@ This analytic is to detect a suspicious modification of time provider registry f The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **time_provider_persistence_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **time_provider_persistence_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ unknown | 80.0 | 80 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://pentestlab.blog/2019/10/22/persistence-time-providers/](https://pentestlab.blog/2019/10/22/persistence-time-providers/) diff --git a/docs/_posts/2022-01-27-disable_etw_through_registry.md b/docs/_posts/2022-01-27-disable_etw_through_registry.md index 9504be6285..b5105e8257 100644 --- a/docs/_posts/2022-01-27-disable_etw_through_registry.md +++ b/docs/_posts/2022-01-27-disable_etw_through_registry.md @@ -94,7 +94,7 @@ this search is to identify modification in registry to disable ETW windows featu -#### Search +#### Search ``` @@ -114,7 +114,8 @@ this search is to identify modification in registry to disable ETW windows featu The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **disable_etw_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disable_etw_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ network operator may disable this feature of windows but not so common. | 25.0 | 50 | 50 | Disable ETW Through Registry | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/](https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/) diff --git a/docs/_posts/2022-01-27-disable_registry_tool.md b/docs/_posts/2022-01-27-disable_registry_tool.md index f449526c81..844a0b79d8 100644 --- a/docs/_posts/2022-01-27-disable_registry_tool.md +++ b/docs/_posts/2022-01-27-disable_registry_tool.md @@ -94,7 +94,7 @@ This search identifies modification of registry to disable the regedit or regist -#### Search +#### Search ``` @@ -114,7 +114,8 @@ This search identifies modification of registry to disable the regedit or regist The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **disable_registry_tool_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disable_registry_tool_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ admin may disable this application for non technical user. | 40.0 | 40 | 100 | Disabled Registry Tools on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry](https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry) diff --git a/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md b/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md index a0bc800d10..fbdb9cf5df 100644 --- a/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md +++ b/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md @@ -89,7 +89,7 @@ This analytic is to detect a suspicious registry modification to disable securit -#### Search +#### Search ``` @@ -109,7 +109,8 @@ This analytic is to detect a suspicious registry modification to disable securit The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **disable_security_logs_using_minint_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disable_security_logs_using_minint_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ Unknown. | 80.0 | 80 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://twitter.com/0gtweet/status/1182516740955226112](https://twitter.com/0gtweet/status/1182516740955226112) diff --git a/docs/_posts/2022-01-27-disable_show_hidden_files.md b/docs/_posts/2022-01-27-disable_show_hidden_files.md index 7579caf3c2..2c45f86d07 100644 --- a/docs/_posts/2022-01-27-disable_show_hidden_files.md +++ b/docs/_posts/2022-01-27-disable_show_hidden_files.md @@ -104,7 +104,7 @@ The following analytic is to identify a modification in the Windows registry to -#### Search +#### Search ``` @@ -124,7 +124,8 @@ The following analytic is to identify a modification in the Windows registry to The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **disable_show_hidden_files_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disable_show_hidden_files_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -155,6 +156,9 @@ unknown | 40.0 | 40 | 100 | Disabled 'Show Hidden Files' on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis.aspx](https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis.aspx) diff --git a/docs/_posts/2022-01-27-disable_uac_remote_restriction.md b/docs/_posts/2022-01-27-disable_uac_remote_restriction.md index 7667377593..52dfda2ad1 100644 --- a/docs/_posts/2022-01-27-disable_uac_remote_restriction.md +++ b/docs/_posts/2022-01-27-disable_uac_remote_restriction.md @@ -96,7 +96,7 @@ This analytic is to detect a suspicious modification of registry to disable UAC -#### Search +#### Search ``` @@ -116,7 +116,8 @@ This analytic is to detect a suspicious modification of registry to disable UAC The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **disable_uac_remote_restriction_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disable_uac_remote_restriction_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ admin may set this policy for non-critical machine. | 80.0 | 80 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction](https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction) diff --git a/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md b/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md index c02bf71d6e..5cce0988ec 100644 --- a/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md +++ b/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md @@ -94,7 +94,7 @@ This analytic detects a suspicious registry modification to disable Windows hotk -#### Search +#### Search ``` @@ -114,7 +114,8 @@ This analytic detects a suspicious registry modification to disable Windows hotk The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **disable_windows_app_hotkeys_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disable_windows_app_hotkeys_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ unknown | 40.0 | 40 | 100 | Disabled 'Windows App Hotkeys' on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md b/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md index eb8929d41e..db3f62dedc 100644 --- a/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md +++ b/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md @@ -94,7 +94,7 @@ This search is to identifies a modification in registry to disable the windows d -#### Search +#### Search ``` @@ -114,7 +114,8 @@ This search is to identifies a modification in registry to disable the windows d The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **disable_windows_behavior_monitoring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disable_windows_behavior_monitoring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ admin or user may choose to disable this windows features. | 40.0 | 40 | 100 | Windows Defender real time behavior monitoring disabled on $dest | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html](https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html) diff --git a/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md b/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md index 20ec21c26d..365fe9129e 100644 --- a/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md +++ b/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md @@ -94,7 +94,7 @@ The following search identifies a modification of registry to disable the smarts -#### Search +#### Search ``` @@ -114,7 +114,8 @@ The following search identifies a modification of registry to disable the smarts The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **disable_windows_smartscreen_protection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disable_windows_smartscreen_protection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ admin or user may choose to disable this windows features. | 25.0 | 50 | 50 | The Windows Smartscreen was disabled on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html](https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html) diff --git a/docs/_posts/2022-01-27-disabling_cmd_application.md b/docs/_posts/2022-01-27-disabling_cmd_application.md index 3fd64e752c..1b0d437892 100644 --- a/docs/_posts/2022-01-27-disabling_cmd_application.md +++ b/docs/_posts/2022-01-27-disabling_cmd_application.md @@ -94,7 +94,7 @@ this search is to identify modification in registry to disable cmd prompt applic -#### Search +#### Search ``` @@ -114,7 +114,8 @@ this search is to identify modification in registry to disable cmd prompt applic The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **disabling_cmd_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disabling_cmd_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ admin may disable this application for non technical user. | 25.0 | 50 | 50 | The Windows command prompt was disabled on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry](https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry) diff --git a/docs/_posts/2022-01-27-disabling_controlpanel.md b/docs/_posts/2022-01-27-disabling_controlpanel.md index d30eb9216a..2f55f1fdc6 100644 --- a/docs/_posts/2022-01-27-disabling_controlpanel.md +++ b/docs/_posts/2022-01-27-disabling_controlpanel.md @@ -94,7 +94,7 @@ this search is to identify registry modification to disable control panel window -#### Search +#### Search ``` @@ -114,7 +114,8 @@ this search is to identify registry modification to disable control panel window The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **disabling_controlpanel_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disabling_controlpanel_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ admin may disable this application for non technical user. | 25.0 | 50 | 50 | The Windows Control Panel was disabled on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry](https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry) diff --git a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md index eea0c139ad..5be08885fe 100644 --- a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md +++ b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md @@ -100,7 +100,7 @@ The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll. -#### Search +#### Search ``` `sysmon` EventCode=10 TargetImage=*lsass.exe GrantedAccess IN ("0x01000", "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x143a", "0x1438", "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*") @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **windows_possible_credential_dumping_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_possible_credential_dumping_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,6 +151,9 @@ False positives will occur based on GrantedAccess 0x1010 and 0x1400, filter base | 64.0 | 80 | 80 | A process, $SourceImage$, has loaded $ImageLoaded$ that are typically related to credential dumping on $dest$. Review for further details. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service](https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service) diff --git a/docs/_posts/2022-01-28-disabling_defender_services.md b/docs/_posts/2022-01-28-disabling_defender_services.md index 49c35fb5b6..b6cec46011 100644 --- a/docs/_posts/2022-01-28-disabling_defender_services.md +++ b/docs/_posts/2022-01-28-disabling_defender_services.md @@ -94,7 +94,7 @@ This particular behavior is typically executed when an adversaries or malware ga -#### Search +#### Search ``` @@ -114,7 +114,8 @@ This particular behavior is typically executed when an adversaries or malware ga The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **disabling_defender_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disabling_defender_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ admin or user may choose to disable windows defender product | 49.0 | 70 | 70 | modified/added/deleted registry entry $registry_path$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/) diff --git a/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md b/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md index 9919bc4270..14a0581efd 100644 --- a/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md +++ b/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md @@ -94,7 +94,7 @@ This search is to identify registry modification to disable folder options featu -#### Search +#### Search ``` @@ -114,7 +114,8 @@ This search is to identify registry modification to disable folder options featu The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **disabling_folderoptions_windows_feature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disabling_folderoptions_windows_feature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ admin may disable this application for non technical user. | 25.0 | 50 | 50 | The Windows Folder Options, to hide files, was disabled on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry](https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry) diff --git a/docs/_posts/2022-01-28-disabling_norun_windows_app.md b/docs/_posts/2022-01-28-disabling_norun_windows_app.md index 7e81c9f40f..a1910fef76 100644 --- a/docs/_posts/2022-01-28-disabling_norun_windows_app.md +++ b/docs/_posts/2022-01-28-disabling_norun_windows_app.md @@ -94,7 +94,7 @@ This search is to identify modification of registry to disable run application i -#### Search +#### Search ``` @@ -114,7 +114,8 @@ This search is to identify modification of registry to disable run application i The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **disabling_norun_windows_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disabling_norun_windows_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ admin may disable this application for non technical user. | 25.0 | 50 | 50 | The Windows registry was modified to disable run application in window start menu on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry](https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry) diff --git a/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md b/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md index 57694d0f6d..6da7aead2c 100644 --- a/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md +++ b/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md @@ -89,7 +89,7 @@ The following search identifies the modification of registry related in disablin -#### Search +#### Search ``` @@ -109,7 +109,8 @@ The following search identifies the modification of registry related in disablin The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **disabling_systemrestore_in_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disabling_systemrestore_in_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +141,9 @@ in some cases admin can disable systemrestore on a machine. | 49.0 | 70 | 70 | The Windows registry was modified to disable system restore on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html](https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html) diff --git a/docs/_posts/2022-01-28-disabling_task_manager.md b/docs/_posts/2022-01-28-disabling_task_manager.md index 5fd539e8ba..d1fd5180f0 100644 --- a/docs/_posts/2022-01-28-disabling_task_manager.md +++ b/docs/_posts/2022-01-28-disabling_task_manager.md @@ -94,7 +94,7 @@ This search is to identifies modification of registry to disable the task manage -#### Search +#### Search ``` @@ -114,7 +114,8 @@ This search is to identifies modification of registry to disable the task manage The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **disabling_task_manager_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disabling_task_manager_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ admin may disable this application for non technical user. | 42.0 | 70 | 60 | The Windows Task Manager was disabled on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry](https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry) diff --git a/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md b/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md index 31897cbc00..82d1a16e3b 100644 --- a/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md +++ b/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md @@ -89,7 +89,7 @@ This search is to detect a modification to registry to enable rdp to a machine w -#### Search +#### Search ``` @@ -109,7 +109,8 @@ This search is to detect a modification to registry to enable rdp to a machine w The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **enable_rdp_in_other_port_number_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **enable_rdp_in_other_port_number_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ unknown | 80.0 | 80 | 100 | RDP was moved to a non-standard port on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.mvps.net/docs/how-to-secure-remote-desktop-rdp/](https://www.mvps.net/docs/how-to-secure-remote-desktop-rdp/) diff --git a/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md b/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md index c48814e40b..e6973f2cb6 100644 --- a/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md +++ b/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md @@ -94,7 +94,7 @@ This analytic is to detect a suspicious registry modification to enable plain te -#### Search +#### Search ``` @@ -114,7 +114,8 @@ This analytic is to detect a suspicious registry modification to enable plain te The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **enable_wdigest_uselogoncredential_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **enable_wdigest_uselogoncredential_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ unknown | 80.0 | 80 | 100 | wdigest registry $registry_path$ was modified in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html](https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html) diff --git a/docs/_posts/2022-01-28-etw_registry_disabled.md b/docs/_posts/2022-01-28-etw_registry_disabled.md index a39de54409..b980e4c789 100644 --- a/docs/_posts/2022-01-28-etw_registry_disabled.md +++ b/docs/_posts/2022-01-28-etw_registry_disabled.md @@ -99,7 +99,7 @@ This analytic is to detect a registry modification to disable ETW feature of win -#### Search +#### Search ``` @@ -119,7 +119,8 @@ This analytic is to detect a registry modification to disable ETW feature of win The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **etw_registry_disabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **etw_registry_disabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ unknown | 90.0 | 90 | 100 | modified/added/deleted registry entry $Registry.registry_path$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3](https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3) diff --git a/docs/_posts/2022-01-28-eventvwr_uac_bypass.md b/docs/_posts/2022-01-28-eventvwr_uac_bypass.md index 331bf13b04..e0c4d58d79 100644 --- a/docs/_posts/2022-01-28-eventvwr_uac_bypass.md +++ b/docs/_posts/2022-01-28-eventvwr_uac_bypass.md @@ -96,7 +96,7 @@ The following search identifies Eventvwr bypass by identifying the registry modi -#### Search +#### Search ``` @@ -116,7 +116,8 @@ The following search identifies Eventvwr bypass by identifying the registry modi The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **eventvwr_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **eventvwr_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ Some false positives may be present and will need to be filtered. | 80.0 | 80 | 100 | Registry values were modified to bypass UAC using Event Viewer on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/](https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/) diff --git a/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md b/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md index bea9919622..9308b22159 100644 --- a/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md +++ b/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md @@ -94,7 +94,7 @@ This analytic identifies a suspicious registry modification to hide a user accou -#### Search +#### Search ``` @@ -114,7 +114,8 @@ This analytic identifies a suspicious registry modification to hide a user accou The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **hide_user_account_from_sign-in_screen_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **hide_user_account_from_sign-in_screen_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ Unknown. Filter as needed. | 72.0 | 90 | 80 | Suspicious registry modification ($registry_value_name$) which is used go hide a user account on the Windows Login screen detected on $dest$ executed by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md b/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md index e945cf3761..3c82a3c3bd 100644 --- a/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md +++ b/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md @@ -94,7 +94,7 @@ The following analytic identifies `pkexec` spawning with no command-line argumen -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_pkexec_privilege_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_pkexec_privilege_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ False positives may be present, filter as needed. | 56.0 | 80 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ related to a local privilege escalation in polkit pkexec. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.reddit.com/r/crowdstrike/comments/sdfeig/20220126_cool_query_friday_hunting_pwnkit_local/](https://www.reddit.com/r/crowdstrike/comments/sdfeig/20220126_cool_query_friday_hunting_pwnkit_local/) diff --git a/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md b/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md index 5178ab8854..6cb0dda1e0 100644 --- a/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md +++ b/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md @@ -96,7 +96,7 @@ The following analytic looks for the use of Mimikatz command line parameters lev -#### Search +#### Search ``` @@ -112,7 +112,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **mimikatz_passtheticket_commandline_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **mimikatz_passtheticket_commandline_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ Although highly unlikely, legitimate applications may use the same command line | 36.0 | 60 | 60 | Mimikatz command line parameters for pass the ticket attacks were used on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz) diff --git a/docs/_posts/2022-02-01-rubeus_command_line_parameters.md b/docs/_posts/2022-02-01-rubeus_command_line_parameters.md index 4758c1d679..5ca8afecc3 100644 --- a/docs/_posts/2022-02-01-rubeus_command_line_parameters.md +++ b/docs/_posts/2022-02-01-rubeus_command_line_parameters.md @@ -111,7 +111,7 @@ Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily ad -#### Search +#### Search ``` @@ -127,7 +127,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **rubeus_command_line_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **rubeus_command_line_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -160,6 +161,9 @@ Although unlikely, legitimate applications may use the same command line paramet | 36.0 | 60 | 60 | Rubeus command line parameters were used on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/GhostPack/Rubeus](https://github.com/GhostPack/Rubeus) diff --git a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md index 66fadaef4e..d124e85f2e 100644 --- a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md +++ b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md @@ -89,7 +89,7 @@ Certutil.exe may download a file from a remote destination using `-urlcache`. Th -#### Search +#### Search ``` @@ -106,7 +106,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **certutil_download_with_urlcache_and_split_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **certutil_download_with_urlcache_and_split_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ Limited false positives in most environments, however tune as needed based on pa | 90.0 | 90 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1105/](https://attack.mitre.org/techniques/T1105/) diff --git a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md index de08ca7b6a..30f4cba28a 100644 --- a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md +++ b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md @@ -89,7 +89,7 @@ Certutil.exe may download a file from a remote destination using `-VerifyCtl`. T -#### Search +#### Search ``` @@ -106,7 +106,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **certutil_download_with_verifyctl_and_split_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **certutil_download_with_verifyctl_and_split_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ Limited false positives in most environments, however tune as needed based on pa | 90.0 | 90 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1105/](https://attack.mitre.org/techniques/T1105/) diff --git a/docs/_posts/2022-02-03-o365_added_service_principal.md b/docs/_posts/2022-02-03-o365_added_service_principal.md index 839cf08a4e..23f868393b 100644 --- a/docs/_posts/2022-02-03-o365_added_service_principal.md +++ b/docs/_posts/2022-02-03-o365_added_service_principal.md @@ -93,7 +93,7 @@ This search detects the creation of a new Federation setting by alerting about a -#### Search +#### Search ``` `o365_management_activity` Workload=AzureActiveDirectory Operation="Add service principal credentials." @@ -108,7 +108,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) -Note that **o365_added_service_principal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **o365_added_service_principal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ The creation of a new Federation is not necessarily malicious, however these eve | 42.0 | 70 | 60 | User $Actor.ID$ created a new federation setting on $Target.ID$ and added service principal credentials from IP Address $ActorIpAddress$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf](https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf) diff --git a/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md b/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md index 20a714eb3c..4c9c1ff46b 100644 --- a/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md +++ b/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md @@ -93,7 +93,7 @@ This search detects newly added IP addresses/CIDR blocks to the list of MFA Trus -#### Search +#### Search ``` `o365_management_activity` Operation="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy @@ -113,7 +113,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) -Note that **o365_bypass_mfa_via_trusted_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **o365_bypass_mfa_via_trusted_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ Unless it is a special case, it is uncommon to continually update Trusted IPs to | 42.0 | 70 | 60 | User $user_id$ has added new IP addresses $ip_addresses_new_added$ to a list of trusted IPs to bypass MFA | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf](https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf) diff --git a/docs/_posts/2022-02-03-o365_disable_mfa.md b/docs/_posts/2022-02-03-o365_disable_mfa.md index 888f04db2c..35f00e5896 100644 --- a/docs/_posts/2022-02-03-o365_disable_mfa.md +++ b/docs/_posts/2022-02-03-o365_disable_mfa.md @@ -90,7 +90,7 @@ This search detects when multi factor authentication has been disabled, what ent -#### Search +#### Search ``` `o365_management_activity` Operation="Disable Strong Authentication." @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) -Note that **o365_disable_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **o365_disable_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ Unless it is a special case, it is uncommon to disable MFA or Strong Authenticat | 64.0 | 80 | 80 | User $user$ has executed an operation $Operation$ for this destination $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1556/](https://attack.mitre.org/techniques/T1556/) diff --git a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md index a29d23232e..7dcf9c4e13 100644 --- a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md +++ b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md @@ -95,7 +95,7 @@ The following analytic looks for a process accessing the winlogon.exe system pro -#### Search +#### Search ``` `sysmon` EventCode=10 TargetImage=C:\\Windows\\system32\\winlogon.exe (GrantedAccess=0x1f3fff) (SourceImage!=C:\\Windows\\system32\\svchost.exe AND SourceImage!=C:\\Windows\\system32\\lsass.exe AND SourceImage!=C:\\Windows\\system32\\LogonUI.exe AND SourceImage!=C:\\Windows\\system32\\smss.exe AND SourceImage!=C:\\Windows\\system32\\wbem\\wmiprvse.exe) @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **rubeus_kerberos_ticket_exports_through_winlogon_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **rubeus_kerberos_ticket_exports_through_winlogon_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ Legitimate applications may obtain a handle for winlogon.exe. Filter as needed | 36.0 | 60 | 60 | Winlogon.exe was accessed by $SourceImage$ on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/GhostPack/Rubeus](https://github.com/GhostPack/Rubeus) diff --git a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md index 7815f7676f..3baffe3234 100644 --- a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md +++ b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md @@ -90,7 +90,7 @@ The following analytic identifies the use of Microsoft Remote Assistance, msra.e -#### Search +#### Search ``` @@ -104,10 +104,11 @@ The following analytic identifies the use of Microsoft Remote Assistance, msra.e #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_remote_assistance_spawning_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_remote_assistance_spawning_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ False positives should be limited, filter as needed. Add additional shells as ne | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$, generating behavior not common with msra.exe. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/](https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/) diff --git a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md index 8eca412d70..5275ef3d5e 100644 --- a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md +++ b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md @@ -98,7 +98,7 @@ The following analytic identifies Schtasks.exe creating a new task to start and -#### Search +#### Search ``` @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_schtasks](https://github.com/splunk/security_content/blob/develop/macros/process_schtasks.yml) -Note that **windows_schtasks_create_run_as_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_schtasks_create_run_as_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ False positives will be limited to legitimate applications creating a task to ru | 48.0 | 80 | 60 | An $process_name$ was created on endpoint $dest$ attempting to spawn as SYSTEM. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://pentestlab.blog/2019/11/04/persistence-scheduled-tasks/](https://pentestlab.blog/2019/11/04/persistence-scheduled-tasks/) diff --git a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md index 19668efe9d..c524fdfaa7 100644 --- a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md +++ b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md @@ -1,6 +1,6 @@ --- title: "RunDLL Loading DLL By Ordinal" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Rundll32 " categories: @@ -9,7 +9,7 @@ last_modified_at: 2022-02-08 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Rundll32 - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ The following analytic identifies rundll32.exe loading an export function by ord | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | @@ -99,7 +99,7 @@ The following analytic identifies rundll32.exe loading an export function by ord -#### Search +#### Search ``` @@ -113,11 +113,12 @@ The following analytic identifies rundll32.exe loading an export function by ord #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -Note that **rundll_loading_dll_by_ordinal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **rundll_loading_dll_by_ordinal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -155,6 +156,9 @@ False positives are possible with native utilities and third party applications. | 49.0 | 70 | 70 | A rundll32 process $process_name$ with ordinal parameter like this process commandline $process$ on host $dest$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/](https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/) diff --git a/docs/_posts/2022-02-08-unusual_number_of_kerberos_service_tickets_requested.md b/docs/_posts/2022-02-08-unusual_number_of_kerberos_service_tickets_requested.md index 1926e35390..fe702e079b 100644 --- a/docs/_posts/2022-02-08-unusual_number_of_kerberos_service_tickets_requested.md +++ b/docs/_posts/2022-02-08-unusual_number_of_kerberos_service_tickets_requested.md @@ -94,7 +94,7 @@ The detection calculates the standard deviation for each host and leverages the -#### Search +#### Search ``` `wineventlog_security` EventCode=4769 Service_Name!="*$" Ticket_Encryption_Type=0x17 @@ -111,7 +111,8 @@ The detection calculates the standard deviation for each host and leverages the The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **unusual_number_of_kerberos_service_tickets_requested_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **unusual_number_of_kerberos_service_tickets_requested_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ An single endpoint requesting a large number of kerberos service tickets is not | 36.0 | 60 | 60 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1558/003/](https://attack.mitre.org/techniques/T1558/003/) diff --git a/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md b/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md index 10b9488ba4..c471caa50d 100644 --- a/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md +++ b/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md @@ -98,7 +98,7 @@ The following analytic leverages Kerberos Event 4769, A Kerberos service ticket -#### Search +#### Search ``` `wineventlog_security` EventCode=4769 Service_Name!="*$" (Ticket_Options=0x40810000 OR Ticket_Options=0x40800000 OR Ticket_Options=0x40810010) Ticket_Encryption_Type=0x17 @@ -110,10 +110,11 @@ The following analytic leverages Kerberos Event 4769, A Kerberos service ticket #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **kerberoasting_spn_request_with_rc4_encryption_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kerberoasting_spn_request_with_rc4_encryption_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ Older systems that support kerberos RC4 by default like NetApp may generate fals | 72.0 | 90 | 80 | Potential kerberoasting attack via service principal name requests detected on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1208/T1208.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1208/T1208.md) diff --git a/docs/_posts/2022-02-11-linux_system_network_discovery.md b/docs/_posts/2022-02-11-linux_system_network_discovery.md index 95d73bf6b5..7f2eb1eb93 100644 --- a/docs/_posts/2022-02-11-linux_system_network_discovery.md +++ b/docs/_posts/2022-02-11-linux_system_network_discovery.md @@ -95,7 +95,7 @@ This analytic is to look for possible enumeration of local network configuration -#### Search +#### Search ``` @@ -109,7 +109,8 @@ This analytic is to look for possible enumeration of local network configuration The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_system_network_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_system_network_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ Administrator or network operator can execute this command. Please update the fi | 9.0 | 30 | 30 | A commandline $process$ executed on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1016/T1016.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1016/T1016.md) diff --git a/docs/_posts/2022-02-14-linux_dd_file_overwrite.md b/docs/_posts/2022-02-14-linux_dd_file_overwrite.md index 221dc843a7..7c59659997 100644 --- a/docs/_posts/2022-02-14-linux_dd_file_overwrite.md +++ b/docs/_posts/2022-02-14-linux_dd_file_overwrite.md @@ -95,7 +95,7 @@ This analytic is to look for dd command to overwrite file. This technique was ab -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_dd_file_overwrite_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_dd_file_overwrite_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ Administrator or network operator can execute this command. Please update the fi | 64.0 | 80 | 80 | A commandline $process$ executed on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://gtfobins.github.io/gtfobins/dd/](https://gtfobins.github.io/gtfobins/dd/) diff --git a/docs/_posts/2022-02-15-detection_of_dns_tunnels.md b/docs/_posts/2022-02-15-detection_of_dns_tunnels.md index 436c7b933c..0a56acc766 100644 --- a/docs/_posts/2022-02-15-detection_of_dns_tunnels.md +++ b/docs/_posts/2022-02-15-detection_of_dns_tunnels.md @@ -1,6 +1,6 @@ --- title: "Detection of DNS Tunnels" -excerpt: "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol +excerpt: "Exfiltration Over Unencrypted Non-C2 Protocol " categories: - Deprecated @@ -8,7 +8,7 @@ last_modified_at: 2022-02-15 toc: true toc_label: "" tags: - - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol + - Exfiltration Over Unencrypted Non-C2 Protocol - Exfiltration - Splunk Enterprise - Splunk Enterprise Security @@ -43,7 +43,7 @@ NOTE:Deprecated because existing detection is doing the same. This detection is | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration | +| [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted Non-C2 Protocol | Exfiltration | @@ -96,7 +96,7 @@ NOTE:Deprecated because existing detection is doing the same. This detection is -#### Search +#### Search ``` @@ -118,7 +118,8 @@ NOTE:Deprecated because existing detection is doing the same. This detection is The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detection_of_dns_tunnels_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detection_of_dns_tunnels_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ It's possible that normal DNS traffic will exhibit this behavior. If an alert is | 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md index 42af4daaf4..9f58e0cbc6 100644 --- a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md +++ b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md @@ -1,6 +1,6 @@ --- title: "Windows Diskshadow Proxy Execution" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution " categories: - Endpoint @@ -8,7 +8,7 @@ last_modified_at: 2022-02-15 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security @@ -42,7 +42,7 @@ DiskShadow.exe is a Microsoft Signed binary present on Windows Server. It has a | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | @@ -93,7 +93,7 @@ DiskShadow.exe is a Microsoft Signed binary present on Windows Server. It has a -#### Search +#### Search ``` @@ -107,10 +107,11 @@ DiskShadow.exe is a Microsoft Signed binary present on Windows Server. It has a #### Macros The SPL above uses the following Macros: * [process_diskshadow](https://github.com/splunk/security_content/blob/develop/macros/process_diskshadow.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_diskshadow_proxy_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_diskshadow_proxy_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ Administrators using the DiskShadow tool in their infrastructure as a main backu | 49.0 | 70 | 70 | Possible Signed Binary Proxy Execution on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/](https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/) diff --git a/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md b/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md index 1d179583fa..651f22d93b 100644 --- a/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md +++ b/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md @@ -1,7 +1,7 @@ --- title: "Windows Rasautou DLL Execution" excerpt: "Dynamic-link Library Injection -, Signed Binary Proxy Execution +, System Binary Proxy Execution , Process Injection " categories: @@ -11,7 +11,7 @@ toc: true toc_label: "" tags: - Dynamic-link Library Injection - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Process Injection - Defense Evasion - Privilege Escalation @@ -52,7 +52,7 @@ The following analytic identifies the Windows Windows Remote Auto Dialer, rasaut | -------------- | ---------------- |-------------------- | | [T1055.001](https://attack.mitre.org/techniques/T1055/001/) | Dynamic-link Library Injection | Defense Evasion, Privilege Escalation | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | @@ -101,7 +101,7 @@ The following analytic identifies the Windows Windows Remote Auto Dialer, rasaut -#### Search +#### Search ``` @@ -117,7 +117,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_rasautou_dll_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_rasautou_dll_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ False positives will be limited to applications that require Rasautou.exe to loa | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to load a DLL in a suspicious manner. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/mandiant/DueDLLigence](https://github.com/mandiant/DueDLLigence) diff --git a/docs/_posts/2022-02-17-windows_disable_notification_center.md b/docs/_posts/2022-02-17-windows_disable_notification_center.md index e1d92a1968..19ec2e9dd0 100644 --- a/docs/_posts/2022-02-17-windows_disable_notification_center.md +++ b/docs/_posts/2022-02-17-windows_disable_notification_center.md @@ -94,7 +94,7 @@ The following search identifies a modification of registry to disable the window -#### Search +#### Search ``` @@ -114,7 +114,8 @@ The following search identifies a modification of registry to disable the window The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_disable_notification_center_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_disable_notification_center_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ admin or user may choose to disable this windows features. | 48.0 | 60 | 80 | The Windows notification center was disabled on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html](https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html) diff --git a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md index a2a51372e9..e694e72012 100644 --- a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md +++ b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md @@ -100,7 +100,7 @@ This analytic is to look for suspicious raw access read to drive where the maste -#### Search +#### Search ``` `sysmon` EventCode=9 Device = \\Device\\Harddisk0\\DR0 NOT (Image IN("*\\Windows\\System32\\*", "*\\Windows\\SysWOW64\\*")) @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **windows_raw_access_to_master_boot_record_drive_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_raw_access_to_master_boot_record_drive_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,6 +151,9 @@ This event is really notable but we found minimal number of normal application f | 90.0 | 90 | 100 | process accessing MBR $device$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.splunk.com/en_us/blog/security/threat-advisory-strt-ta02-destructive-software.html](https://www.splunk.com/en_us/blog/security/threat-advisory-strt-ta02-destructive-software.html) diff --git a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md index 9bad0cb87c..853c26e96f 100644 --- a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md +++ b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md @@ -1,6 +1,6 @@ --- title: "Detect Regasm with Network Connection" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Regsvcs/Regasm " categories: @@ -9,7 +9,7 @@ last_modified_at: 2022-02-18 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Regsvcs/Regasm - Defense Evasion - Defense Evasion @@ -44,7 +44,7 @@ The following analytic identifies regasm.exe with a network connection to a publ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion | @@ -98,7 +98,7 @@ The following analytic identifies regasm.exe with a network connection to a publ -#### Search +#### Search ``` `sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 process_name=regasm.exe @@ -114,7 +114,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **detect_regasm_with_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_regasm_with_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,6 +149,9 @@ Although unlikely, limited instances of regasm.exe with a network connection may | 80.0 | 80 | 100 | An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1218/009/](https://attack.mitre.org/techniques/T1218/009/) diff --git a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md index 1634b6ac1f..8fa658fda9 100644 --- a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md +++ b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md @@ -1,6 +1,6 @@ --- title: "Detect Regsvcs with Network Connection" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Regsvcs/Regasm " categories: @@ -9,7 +9,7 @@ last_modified_at: 2022-02-18 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Regsvcs/Regasm - Defense Evasion - Defense Evasion @@ -44,7 +44,7 @@ The following analytic identifies Regsvcs.exe with a network connection to a pub | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion | @@ -98,7 +98,7 @@ The following analytic identifies Regsvcs.exe with a network connection to a pub -#### Search +#### Search ``` `sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 process_name=regsvcs.exe @@ -114,7 +114,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **detect_regsvcs_with_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_regsvcs_with_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ Although unlikely, limited instances of regsvcs.exe may cause a false positive. | 80.0 | 80 | 100 | An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1218/009/](https://attack.mitre.org/techniques/T1218/009/) diff --git a/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md b/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md index b859272adc..4e25e1d358 100644 --- a/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md +++ b/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md @@ -93,7 +93,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 (Message = "*Get-DomainUser*" AND Message="*PreauthNotRequired*") @@ -107,7 +107,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **disabled_kerberos_pre-authentication_discovery_with_powerview_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disabled_kerberos_pre-authentication_discovery_with_powerview_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,6 +137,9 @@ Administrators or power users may use PowerView for troubleshooting | 54.0 | 60 | 90 | Disabled Kerberos Pre-Authentication Discovery With PowerView from $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1558/004/](https://attack.mitre.org/techniques/T1558/004/) diff --git a/docs/_posts/2022-02-18-net_profiler_uac_bypass.md b/docs/_posts/2022-02-18-net_profiler_uac_bypass.md index 4298c17bdf..de1ef87e61 100644 --- a/docs/_posts/2022-02-18-net_profiler_uac_bypass.md +++ b/docs/_posts/2022-02-18-net_profiler_uac_bypass.md @@ -96,7 +96,7 @@ This search is to detect modification of registry to bypass UAC windows feature. -#### Search +#### Search ``` @@ -112,7 +112,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **net_profiler_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **net_profiler_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ limited false positive. It may trigger by some windows update that will modify t | 63.0 | 70 | 90 | Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://offsec.almond.consulting/UAC-bypass-dotnet.html](https://offsec.almond.consulting/UAC-bypass-dotnet.html) diff --git a/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md b/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md index 618de123da..cd2798fb45 100644 --- a/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md +++ b/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md @@ -88,7 +88,7 @@ This search detects when an excessive number of authentication failures occur th -#### Search +#### Search ``` `o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=failure @@ -104,7 +104,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) -Note that **o365_excessive_authentication_failures_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **o365_excessive_authentication_failures_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,6 +136,9 @@ The threshold for alert is above 10 attempts and this should reduce the number o | 64.0 | 80 | 80 | User $user$ has caused excessive number of authentication failures from $src_ip$ using UserAgent $UserAgent$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1110/](https://attack.mitre.org/techniques/T1110/) diff --git a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md index 4dfa01b873..31ad7496fe 100644 --- a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md +++ b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md @@ -89,7 +89,7 @@ This detection is to identify a suspicious process that tries to delete the proc -#### Search +#### Search ``` `sysmon` EventCode=1 CommandLine = "* /c *" CommandLine = "* del*" Image = "*\\cmd.exe" @@ -106,7 +106,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **process_deleting_its_process_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **process_deleting_its_process_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * EventCode @@ -142,6 +143,9 @@ unknown | 60.0 | 60 | 100 | A process $Image$ tries to delete its process path in commandline $cmdline$ as part of defense evasion in host $Computer$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html](https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html) diff --git a/docs/_posts/2022-02-18-rundll32_dnsquery.md b/docs/_posts/2022-02-18-rundll32_dnsquery.md index 6f60b4c2c7..eabf4664b9 100644 --- a/docs/_posts/2022-02-18-rundll32_dnsquery.md +++ b/docs/_posts/2022-02-18-rundll32_dnsquery.md @@ -1,6 +1,6 @@ --- title: "Rundll32 DNSQuery" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Rundll32 " categories: @@ -9,7 +9,7 @@ last_modified_at: 2022-02-18 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Rundll32 - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ This search is to detect a suspicious rundll32.exe process having a http connect | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | @@ -94,7 +94,7 @@ This search is to detect a suspicious rundll32.exe process having a http connect -#### Search +#### Search ``` `sysmon` EventCode=22 process_name="rundll32.exe" @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **rundll32_dnsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **rundll32_dnsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +141,9 @@ unknown | 56.0 | 70 | 80 | rundll32 process $process_name$ having a dns query to $QueryName$ in host $Computer$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://any.run/malware-trends/icedid](https://any.run/malware-trends/icedid) diff --git a/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md b/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md index 24930060c1..6300fa79d4 100644 --- a/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md +++ b/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md @@ -100,7 +100,7 @@ Monitor for changes of the ExecutionPolicy in the registry to the values "unrest -#### Search +#### Search ``` @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,6 +149,9 @@ Administrators may attempt to change the default execution policy on a system fo | 48.0 | 60 | 80 | A registry modification in $registry_path$ with reg key $registry_key_name$ and reg value $registry_value_name$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md b/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md index 715a15885a..dd7d59e564 100644 --- a/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md +++ b/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md @@ -93,7 +93,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 (Message = "*Get-ADUser*" AND Message="*4194304*") @@ -107,7 +107,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **disabled_kerberos_pre-authentication_discovery_with_get-aduser_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **disabled_kerberos_pre-authentication_discovery_with_get-aduser_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,6 +137,9 @@ Administrators or power users may use search for accounts with Kerberos Pre Auth | 54.0 | 60 | 90 | Disabled Kerberos Pre-Authentication Discovery With Get-ADUser from $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1558/004/](https://attack.mitre.org/techniques/T1558/004/) diff --git a/docs/_posts/2022-02-22-kerberos_pre-authentication_flag_disabled_in_useraccountcontrol.md b/docs/_posts/2022-02-22-kerberos_pre-authentication_flag_disabled_in_useraccountcontrol.md index 5c90cd0cd6..49f1dac279 100644 --- a/docs/_posts/2022-02-22-kerberos_pre-authentication_flag_disabled_in_useraccountcontrol.md +++ b/docs/_posts/2022-02-22-kerberos_pre-authentication_flag_disabled_in_useraccountcontrol.md @@ -93,7 +93,7 @@ The following analytic leverages Windows Security Event 4738, `A user account wa -#### Search +#### Search ``` `wineventlog_security` EventCode=4738 MSADChangedAttributes="*Don't Require Preauth' - Enabled*" @@ -105,7 +105,8 @@ The following analytic leverages Windows Security Event 4738, `A user account wa The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **kerberos_pre-authentication_flag_disabled_in_useraccountcontrol_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kerberos_pre-authentication_flag_disabled_in_useraccountcontrol_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,6 +135,9 @@ Unknown. | 45.0 | 50 | 90 | Kerberos Pre Authentication was Disabled for $Account_Name$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties](https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties) diff --git a/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md b/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md index 6d3c53d68b..80c79551e7 100644 --- a/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md +++ b/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md @@ -102,7 +102,7 @@ The following analytic identifies the creation or deletion of a scheduled task u -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **scheduled_task_deleted_or_created_via_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **scheduled_task_deleted_or_created_via_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,6 +153,9 @@ It is possible scripts or administrators may trigger this analytic. Filter as ne | 56.0 | 70 | 80 | A schedule task process $process_name$ with create or delete commandline $process$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/](https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/) diff --git a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md index 52f26459f7..b4091d27d8 100644 --- a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md +++ b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md @@ -95,7 +95,7 @@ This analytic is to look for wmi commandlines to execute or create process. This -#### Search +#### Search ``` @@ -112,7 +112,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_wmi_process_call_create_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_wmi_process_call_create_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ Administrators may execute this command for testing or auditing. | 25.0 | 50 | 50 | process with $process$ commandline executed in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/NVISOsecurity/sigma-public/blob/master/rules/windows/process_creation/win_susp_wmi_execution.yml](https://github.com/NVISOsecurity/sigma-public/blob/master/rules/windows/process_creation/win_susp_wmi_execution.yml) diff --git a/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md b/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md index ea307a14ee..bfcbee171d 100644 --- a/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md +++ b/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md @@ -100,7 +100,7 @@ This analytic will identify suspicious excessive number of system events of serv -#### Search +#### Search ``` `wineventlog_system` EventCode=7040 Message = "*service was changed from demand start to disabled." @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) -Note that **windows_excessive_disabled_services_event_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_excessive_disabled_services_event_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ Unknown | 81.0 | 90 | 90 | Service was disabled in $Computer$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://blog.talosintelligence.com/2018/02/olympic-destroyer.html](https://blog.talosintelligence.com/2018/02/olympic-destroyer.html) diff --git a/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md b/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md index ff50c7cf2c..5cf7fc9718 100644 --- a/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md +++ b/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md @@ -96,7 +96,7 @@ This analytic is to look for process commandline that contains named pipe. This -#### Search +#### Search ``` @@ -112,7 +112,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_process_with_namedpipe_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_process_with_namedpipe_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ Normal browser application may use this technique. Please update the filter macr | 49.0 | 70 | 70 | Process with named pipe in $process$ on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://blog.talosintelligence.com/2018/02/olympic-destroyer.html](https://blog.talosintelligence.com/2018/02/olympic-destroyer.html) diff --git a/docs/_posts/2022-02-23-windows_service_creation_using_registry_entry.md b/docs/_posts/2022-02-23-windows_service_creation_using_registry_entry.md index 4787c272ee..63a2b37849 100644 --- a/docs/_posts/2022-02-23-windows_service_creation_using_registry_entry.md +++ b/docs/_posts/2022-02-23-windows_service_creation_using_registry_entry.md @@ -97,7 +97,7 @@ This analytic is to look for suspicious modification or creation of registry to -#### Search +#### Search ``` @@ -117,7 +117,8 @@ This analytic is to look for suspicious modification or creation of registry to The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_service_creation_using_registry_entry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_service_creation_using_registry_entry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -157,6 +158,9 @@ Third party tools may used this technique to create services but not so common. | 64.0 | 80 | 80 | A Windows Service was created on a endpoint from $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1574.011/T1574.011.md](https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1574.011/T1574.011.md) diff --git a/docs/_posts/2022-02-24-aws_lambda_updatefunctioncode.md b/docs/_posts/2022-02-24-aws_lambda_updatefunctioncode.md index a95a00e40d..e37d1c02d1 100644 --- a/docs/_posts/2022-02-24-aws_lambda_updatefunctioncode.md +++ b/docs/_posts/2022-02-24-aws_lambda_updatefunctioncode.md @@ -94,7 +94,7 @@ This analytic is designed to detect IAM users attempting to update/modify AWS la -#### Search +#### Search ``` `cloudtrail` eventSource=lambda.amazonaws.com eventName=UpdateFunctionCode* errorCode = success user_type=IAMUser @@ -106,7 +106,8 @@ This analytic is designed to detect IAM users attempting to update/modify AWS la The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_lambda_updatefunctioncode_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_lambda_updatefunctioncode_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,6 +135,9 @@ While this search has no known false positives, it is possible that an AWS admin | 63.0 | 70 | 90 | User $user_arn$ is attempting to update the lambda function code of $function_updated$ from this IP $src_ip$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [http://detectioninthe.cloud/execution/modify_lambda_function_code/](http://detectioninthe.cloud/execution/modify_lambda_function_code/) diff --git a/docs/_posts/2022-02-25-windows_disable_memory_crash_dump.md b/docs/_posts/2022-02-25-windows_disable_memory_crash_dump.md index f76480af6f..07182f3322 100644 --- a/docs/_posts/2022-02-25-windows_disable_memory_crash_dump.md +++ b/docs/_posts/2022-02-25-windows_disable_memory_crash_dump.md @@ -95,7 +95,7 @@ The following analytic identifies a process that is attempting to disable the ab -#### Search +#### Search ``` @@ -113,7 +113,8 @@ The following analytic identifies a process that is attempting to disable the ab The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_disable_memory_crash_dump_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_disable_memory_crash_dump_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -154,6 +155,9 @@ unknown | 90.0 | 90 | 100 | A process $process_name$ was identified attempting to disable memory crash dumps on $dest$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html](https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html) diff --git a/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md b/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md index 9384d44b84..b4d0bec646 100644 --- a/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md +++ b/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md @@ -95,7 +95,7 @@ This analytic is to look for suspicious file creation in the critical folder lik -#### Search +#### Search ``` @@ -117,7 +117,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_file_without_extension_in_critical_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_file_without_extension_in_critical_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ Unknown at this point | 90.0 | 90 | 100 | Driver file with out file extension drop in $file_path$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html](https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html) diff --git a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md index 3f5c74d572..e6bcb8620f 100644 --- a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md +++ b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md @@ -100,7 +100,7 @@ This analytic is to look for suspicious raw access read to device disk partition -#### Search +#### Search ``` `sysmon` EventCode=9 Device = \\Device\\HarddiskVolume* NOT (Image IN("*\\Windows\\System32\\*", "*\\Windows\\SysWOW64\\*")) @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **windows_raw_access_to_disk_volume_partition_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_raw_access_to_disk_volume_partition_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ This event is really notable but we found minimal number of normal application f | 90.0 | 90 | 100 | Process accessing disk partition $device$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html](https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html) diff --git a/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md b/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md index 00d1662e52..2270a4b424 100644 --- a/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md +++ b/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md @@ -89,7 +89,7 @@ This analytic will identify suspicious series of process executions. We have ob -#### Search +#### Search ``` @@ -106,7 +106,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **excessive_distinct_processes_from_windows_temp_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **excessive_distinct_processes_from_windows_temp_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,6 +135,9 @@ Many benign applications will create processes from executables in Windows\Temp, | 80.0 | 80 | 100 | Multiple processes were executed out of windows\temp within a short amount of time on $dest$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/) diff --git a/docs/_posts/2022-03-02-windows_modify_show_compress_color_and_info_tip_registry.md b/docs/_posts/2022-03-02-windows_modify_show_compress_color_and_info_tip_registry.md index faa6848142..37bf50e905 100644 --- a/docs/_posts/2022-03-02-windows_modify_show_compress_color_and_info_tip_registry.md +++ b/docs/_posts/2022-03-02-windows_modify_show_compress_color_and_info_tip_registry.md @@ -95,7 +95,7 @@ This analytic is to look for suspicious registry modification related to file co -#### Search +#### Search ``` @@ -115,7 +115,8 @@ This analytic is to look for suspicious registry modification related to file co The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_modify_show_compress_color_and_info_tip_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_modify_show_compress_color_and_info_tip_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ unknown | 25.0 | 50 | 50 | Registry modification in "ShowCompColor" and "ShowInfoTips" on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html](https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html) diff --git a/docs/_posts/2022-03-03-aws_createaccesskey.md b/docs/_posts/2022-03-03-aws_createaccesskey.md index ca56be99f3..ce59a7c112 100644 --- a/docs/_posts/2022-03-03-aws_createaccesskey.md +++ b/docs/_posts/2022-03-03-aws_createaccesskey.md @@ -99,7 +99,7 @@ This search looks for AWS CloudTrail events where a user A who has already permi -#### Search +#### Search ``` `cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com errorCode = success @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_createaccesskey_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_createaccesskey_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ While this search has no known false positives, it is possible that an AWS admin | 63.0 | 70 | 90 | User $user_arn$ is attempting to create access keys for $requestParameters.userName$ from this IP $src$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws](https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws) diff --git a/docs/_posts/2022-03-03-aws_updateloginprofile.md b/docs/_posts/2022-03-03-aws_updateloginprofile.md index 0fadc203c4..e6b11cc76d 100644 --- a/docs/_posts/2022-03-03-aws_updateloginprofile.md +++ b/docs/_posts/2022-03-03-aws_updateloginprofile.md @@ -99,7 +99,7 @@ This search looks for AWS CloudTrail events where a user A who has already permi -#### Search +#### Search ``` `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com errorCode = success @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_updateloginprofile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_updateloginprofile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ While this search has no known false positives, it is possible that an AWS admin | 30.0 | 50 | 60 | From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for updating the existing login profile, potentially giving user $user_arn$ more access privilleges | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws](https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws) diff --git a/docs/_posts/2022-03-04-kerberos_tgt_request_using_rc4_encryption.md b/docs/_posts/2022-03-04-kerberos_tgt_request_using_rc4_encryption.md index bbabea9bec..a2b65f52dc 100644 --- a/docs/_posts/2022-03-04-kerberos_tgt_request_using_rc4_encryption.md +++ b/docs/_posts/2022-03-04-kerberos_tgt_request_using_rc4_encryption.md @@ -89,7 +89,7 @@ The following analytic leverages Event 4768, A Kerberos authentication ticket (T -#### Search +#### Search ``` `wineventlog_security` EventCode=4768 Ticket_Encryption_Type=0x17 Account_Name!=*$ @@ -100,7 +100,8 @@ The following analytic leverages Event 4768, A Kerberos authentication ticket (T The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **kerberos_tgt_request_using_rc4_encryption_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kerberos_tgt_request_using_rc4_encryption_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -129,6 +130,9 @@ Based on Microsoft documentation, legacy systems or applications will use RC4-HM | 25.0 | 50 | 50 | A Kerberos TGT request with RC4 encryption was requested for $Account_Name$ from $Client_Address$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://stealthbits.com/blog/how-to-detect-overpass-the-hash-attacks/](https://stealthbits.com/blog/how-to-detect-overpass-the-hash-attacks/) diff --git a/docs/_posts/2022-03-04-macos_lolbin.md b/docs/_posts/2022-03-04-macos_lolbin.md index 192253d6a3..586e56f0e1 100644 --- a/docs/_posts/2022-03-04-macos_lolbin.md +++ b/docs/_posts/2022-03-04-macos_lolbin.md @@ -100,7 +100,7 @@ Detect multiple executions of Living off the Land (LOLbin) binaries in a short p -#### Search +#### Search ``` `osquery` name=es_process_events columns.cmdline IN ("find*", "crontab*", "screencapture*", "openssl*", "curl*", "wget*", "killall*", "funzip*") @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [osquery](https://github.com/splunk/security_content/blob/develop/macros/osquery.yml) -Note that **macos_lolbin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **macos_lolbin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,6 +151,9 @@ None identified. | 25.0 | 50 | 50 | Multiplle LOLbin are executed on host $host$ by user $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://osquery.readthedocs.io/en/stable/deployment/process-auditing/](https://osquery.readthedocs.io/en/stable/deployment/process-auditing/) diff --git a/docs/_posts/2022-03-08-suspicious_msbuild_path.md b/docs/_posts/2022-03-08-suspicious_msbuild_path.md index 3d5a977f7c..80f56f383a 100644 --- a/docs/_posts/2022-03-08-suspicious_msbuild_path.md +++ b/docs/_posts/2022-03-08-suspicious_msbuild_path.md @@ -109,7 +109,7 @@ The following analytic identifies msbuild.exe executing from a non-standard path -#### Search +#### Search ``` @@ -122,11 +122,12 @@ The following analytic identifies msbuild.exe executing from a non-standard path #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **suspicious_msbuild_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_msbuild_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -165,6 +166,9 @@ Some legitimate applications may use a moved copy of msbuild.exe, triggering a f | 49.0 | 70 | 70 | Msbuild.exe ran from an uncommon path on $dest$ execyted by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://lolbas-project.github.io/lolbas/Binaries/Msbuild/](https://lolbas-project.github.io/lolbas/Binaries/Msbuild/) diff --git a/docs/_posts/2022-03-08-windows_disable_change_password_through_registry.md b/docs/_posts/2022-03-08-windows_disable_change_password_through_registry.md index 3e5427dc4d..80d88f0f64 100644 --- a/docs/_posts/2022-03-08-windows_disable_change_password_through_registry.md +++ b/docs/_posts/2022-03-08-windows_disable_change_password_through_registry.md @@ -95,7 +95,7 @@ This analytic is to detect a suspicious registry modification to disable change -#### Search +#### Search ``` @@ -115,7 +115,8 @@ This analytic is to detect a suspicious registry modification to disable change The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_disable_change_password_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_disable_change_password_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ This windows feature may implemented by administrator to prevent normal user to | 49.0 | 70 | 70 | Registry modification in "DisableChangePassword" on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_heartbleed.thdobah](https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_heartbleed.thdobah) diff --git a/docs/_posts/2022-03-08-windows_disable_lock_workstation_feature_through_registry.md b/docs/_posts/2022-03-08-windows_disable_lock_workstation_feature_through_registry.md index cb7fce60c0..b1c026cbbe 100644 --- a/docs/_posts/2022-03-08-windows_disable_lock_workstation_feature_through_registry.md +++ b/docs/_posts/2022-03-08-windows_disable_lock_workstation_feature_through_registry.md @@ -95,7 +95,7 @@ This analytic is to detect a suspicious registry modification to disable Lock Co -#### Search +#### Search ``` @@ -115,7 +115,8 @@ This analytic is to detect a suspicious registry modification to disable Lock Co The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_disable_lock_workstation_feature_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_disable_lock_workstation_feature_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ unknown | 49.0 | 70 | 70 | Registry modification in "DisableLockWorkstation" on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/](https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/) diff --git a/docs/_posts/2022-03-08-windows_disable_logoff_button_through_registry.md b/docs/_posts/2022-03-08-windows_disable_logoff_button_through_registry.md index e772ea10d4..80ea1ac202 100644 --- a/docs/_posts/2022-03-08-windows_disable_logoff_button_through_registry.md +++ b/docs/_posts/2022-03-08-windows_disable_logoff_button_through_registry.md @@ -95,7 +95,7 @@ This analytic is to detect a suspicious registry modification to disable logoff -#### Search +#### Search ``` @@ -115,7 +115,8 @@ This analytic is to detect a suspicious registry modification to disable logoff The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_disable_logoff_button_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_disable_logoff_button_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,6 +153,9 @@ This windows feature may implement by administrator in some server where shutdow | 49.0 | 70 | 70 | Registry modification in "NoLogOff" on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.hybrid-analysis.com/sample/e2d4018fd3bd541c153af98ef7c25b2bf4a66bc3bfb89e437cde89fd08a9dd7b/5b1f4d947ca3e10f22714774](https://www.hybrid-analysis.com/sample/e2d4018fd3bd541c153af98ef7c25b2bf4a66bc3bfb89e437cde89fd08a9dd7b/5b1f4d947ca3e10f22714774) diff --git a/docs/_posts/2022-03-08-windows_disable_shutdown_button_through_registry.md b/docs/_posts/2022-03-08-windows_disable_shutdown_button_through_registry.md index f20834acd2..2f1640abeb 100644 --- a/docs/_posts/2022-03-08-windows_disable_shutdown_button_through_registry.md +++ b/docs/_posts/2022-03-08-windows_disable_shutdown_button_through_registry.md @@ -95,7 +95,7 @@ This analytic is to detect a suspicious registry modification to disable shutdow -#### Search +#### Search ``` @@ -115,7 +115,8 @@ This analytic is to detect a suspicious registry modification to disable shutdow The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_disable_shutdown_button_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_disable_shutdown_button_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,6 +153,9 @@ This windows feature may implement by administrator in some server where shutdow | 49.0 | 70 | 70 | Registry modification in "shutdownwithoutlogon" on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.msil.screenlocker.a/](https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.msil.screenlocker.a/) diff --git a/docs/_posts/2022-03-08-windows_disable_windows_group_policy_features_through_registry.md b/docs/_posts/2022-03-08-windows_disable_windows_group_policy_features_through_registry.md index f202806f35..12084806eb 100644 --- a/docs/_posts/2022-03-08-windows_disable_windows_group_policy_features_through_registry.md +++ b/docs/_posts/2022-03-08-windows_disable_windows_group_policy_features_through_registry.md @@ -95,7 +95,7 @@ This analytic is to detect a suspicious registry modification to disable windows -#### Search +#### Search ``` @@ -115,7 +115,8 @@ This analytic is to detect a suspicious registry modification to disable windows The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_disable_windows_group_policy_features_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_disable_windows_group_policy_features_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ unknown | 49.0 | 70 | 70 | Registry modification to disable windows features on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://hybrid-analysis.com/sample/ef1c427394c205580576d18ba68d5911089c7da0386f19d1ca126929d3e671ab?environmentId=120&lang=en](https://hybrid-analysis.com/sample/ef1c427394c205580576d18ba68d5911089c7da0386f19d1ca126929d3e671ab?environmentId=120&lang=en) diff --git a/docs/_posts/2022-03-08-windows_hide_notification_features_through_registry.md b/docs/_posts/2022-03-08-windows_hide_notification_features_through_registry.md index a5d9b7f072..fa6668e9a6 100644 --- a/docs/_posts/2022-03-08-windows_hide_notification_features_through_registry.md +++ b/docs/_posts/2022-03-08-windows_hide_notification_features_through_registry.md @@ -95,7 +95,7 @@ This analytic is to detect a suspicious registry modification to hide common win -#### Search +#### Search ``` @@ -115,7 +115,8 @@ This analytic is to detect a suspicious registry modification to hide common win The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_hide_notification_features_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_hide_notification_features_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ unknown | 49.0 | 70 | 70 | Registry modification to hide windows notification on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Ransom.Win32.ONALOCKER.A/](https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Ransom.Win32.ONALOCKER.A/) diff --git a/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md b/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md index 129b3b87e1..492eb43d40 100644 --- a/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md +++ b/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md @@ -91,7 +91,7 @@ The following analytic identifies a process performing an outbound connection on -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **unknown_process_using_the_kerberos_protocol_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **unknown_process_using_the_kerberos_protocol_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ Custom applications may leverage the Kerberos protocol. Filter as needed. | 36.0 | 60 | 60 | | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://stealthbits.com/blog/how-to-detect-overpass-the-hash-attacks/](https://stealthbits.com/blog/how-to-detect-overpass-the-hash-attacks/) diff --git a/docs/_posts/2022-03-10-kerberos_user_enumeration.md b/docs/_posts/2022-03-10-kerberos_user_enumeration.md index 6e0d18c126..ca11e5348e 100644 --- a/docs/_posts/2022-03-10-kerberos_user_enumeration.md +++ b/docs/_posts/2022-03-10-kerberos_user_enumeration.md @@ -93,7 +93,7 @@ The following analytic leverages Event Id 4768, A Kerberos authentication ticket -#### Search +#### Search ``` `wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$" @@ -110,7 +110,8 @@ The following analytic leverages Event Id 4768, A Kerberos authentication ticket The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **kerberos_user_enumeration_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kerberos_user_enumeration_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ Possible false positive scenarios include but are not limited to vulnerability s | 24.0 | 30 | 80 | Potential Kerberos based user enumeration attack $Client_Address$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/ropnop/kerbrute](https://github.com/ropnop/kerbrute) diff --git a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md index d91fb06be2..4a51b57c19 100644 --- a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md @@ -1,6 +1,6 @@ --- title: "Detect Regasm with no Command Line Arguments" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Regsvcs/Regasm " categories: @@ -9,7 +9,7 @@ last_modified_at: 2022-03-15 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Regsvcs/Regasm - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ The following analytic identifies regasm.exe with no command line arguments. Thi | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion | @@ -99,7 +99,7 @@ The following analytic identifies regasm.exe with no command line arguments. Thi -#### Search +#### Search ``` @@ -113,11 +113,12 @@ The following analytic identifies regasm.exe with no command line arguments. Thi #### Macros The SPL above uses the following Macros: -* [process_regasm](https://github.com/splunk/security_content/blob/develop/macros/process_regasm.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_regasm](https://github.com/splunk/security_content/blob/develop/macros/process_regasm.yml) -Note that **detect_regasm_with_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_regasm_with_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -154,6 +155,9 @@ Although unlikely, limited instances of regasm.exe or may cause a false positive | 49.0 | 70 | 70 | The process $process_name$ was spawned by $parent_process_name$ without any command-line arguments on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1218/009/](https://attack.mitre.org/techniques/T1218/009/) diff --git a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md index bb44743ba8..5068280f51 100644 --- a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md @@ -1,6 +1,6 @@ --- title: "Detect Regsvcs with No Command Line Arguments" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Regsvcs/Regasm " categories: @@ -9,7 +9,7 @@ last_modified_at: 2022-03-15 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Regsvcs/Regasm - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ The following analytic identifies regsvcs.exe with no command line arguments. Th | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion | @@ -99,7 +99,7 @@ The following analytic identifies regsvcs.exe with no command line arguments. Th -#### Search +#### Search ``` @@ -114,10 +114,11 @@ The following analytic identifies regsvcs.exe with no command line arguments. Th #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_regsvcs](https://github.com/splunk/security_content/blob/develop/macros/process_regsvcs.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_regsvcs](https://github.com/splunk/security_content/blob/develop/macros/process_regsvcs.yml) -Note that **detect_regsvcs_with_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_regsvcs_with_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -154,6 +155,9 @@ Although unlikely, limited instances of regsvcs.exe may cause a false positive. | 49.0 | 70 | 70 | The process $process_name$ was spawned by $parent_process_name$ without any command-line arguments on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1218/009/](https://attack.mitre.org/techniques/T1218/009/) diff --git a/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md index 020ff05ff7..c897bca0d1 100644 --- a/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md +++ b/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md @@ -90,7 +90,7 @@ The following analytic identifies DLLHost.exe with no command line arguments wit -#### Search +#### Search ``` @@ -112,7 +112,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **dllhost_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **dllhost_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ Although unlikely, some legitimate third party applications may use a moved copy | 49.0 | 70 | 70 | The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile](https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile) diff --git a/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md index d41e9c90cb..8b995c0cd9 100644 --- a/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md +++ b/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md @@ -90,7 +90,7 @@ The following analytic identifies gpupdate.exe with no command line arguments an -#### Search +#### Search ``` @@ -112,7 +112,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **gpupdate_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **gpupdate_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ Limited false positives may be present in small environments. Tuning may be requ | 81.0 | 90 | 90 | Process gpupdate.exe with parent_process $parent_process_name$ is executed on $dest$ by user $user$, followed by an outbound network connection to $connection_to_CNC$ on port $dest_port$. This behaviour is seen with cobaltstrike. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile](https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile) diff --git a/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md b/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md index f81ff8e28b..22617d5dad 100644 --- a/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md +++ b/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md @@ -93,7 +93,7 @@ The following analytic leverages Kerberos Event 4769, A Kerberos service ticket -#### Search +#### Search ``` `wineventlog_security` EventCode=4769 Service_Name="*$" (Ticket_Options=0x40810000 OR Ticket_Options=0x40800000 OR Ticket_Options=0x40810010) Ticket_Encryption_Type=0x17 @@ -105,10 +105,11 @@ The following analytic leverages Kerberos Event 4769, A Kerberos service ticket #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **kerberos_service_ticket_request_using_rc4_encryption_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kerberos_service_ticket_request_using_rc4_encryption_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ Based on Microsoft documentation, legacy systems or applications will use RC4-HM | 45.0 | 90 | 50 | A Kerberos Service TTicket request with RC4 encryption was requested from $Client_Address$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1558/001/](https://attack.mitre.org/techniques/T1558/001/) diff --git a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md index bd2db45af6..aeeb2a5286 100644 --- a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md +++ b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md @@ -1,6 +1,6 @@ --- title: "Rundll32 with no Command Line Arguments with Network" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Rundll32 " categories: @@ -9,7 +9,7 @@ last_modified_at: 2022-03-15 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Rundll32 - Defense Evasion - Defense Evasion @@ -46,7 +46,7 @@ The following analytic identifies rundll32.exe with no command line arguments an | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | @@ -99,7 +99,7 @@ The following analytic identifies rundll32.exe with no command line arguments an -#### Search +#### Search ``` @@ -118,11 +118,12 @@ The following analytic identifies rundll32.exe with no command line arguments an #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -Note that **rundll32_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **rundll32_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -160,6 +161,9 @@ Although unlikely, some legitimate applications may use a moved copy of rundll32 | 70.0 | 70 | 100 | A rundll32 process $process_name$ with no commandline argument like this process commandline $process$ in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/) diff --git a/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md b/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md index 10952af0f5..5a6425156b 100644 --- a/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md +++ b/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md @@ -90,7 +90,7 @@ The following analytic identifies searchprotocolhost.exe with no command line ar -#### Search +#### Search ``` @@ -112,7 +112,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **searchprotocolhost_with_no_command_line_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **searchprotocolhost_with_no_command_line_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,6 +143,9 @@ Limited false positives may be present in small environments. Tuning may be requ | 70.0 | 70 | 100 | A searchprotocolhost.exe process $process_name$ with no commandline in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc](https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc) diff --git a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md index 7504f26011..14a6590820 100644 --- a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md @@ -90,7 +90,7 @@ The following analytic identifies DLLHost.exe with no command line arguments. It -#### Search +#### Search ``` @@ -108,7 +108,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_dllhost](https://github.com/splunk/security_content/blob/develop/macros/process_dllhost.yml) -Note that **suspicious_dllhost_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_dllhost_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ Limited false positives may be present in small environments. Tuning may be requ | 49.0 | 70 | 70 | Suspicious dllhost.exe process with no command line arguments executed on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile](https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile) diff --git a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md index e01f0ad5de..7c62bfb06b 100644 --- a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md @@ -90,7 +90,7 @@ The following analytic identifies gpupdate.exe with no command line arguments. I -#### Search +#### Search ``` @@ -104,11 +104,12 @@ The following analytic identifies gpupdate.exe with no command line arguments. I #### Macros The SPL above uses the following Macros: -* [process_gpupdate](https://github.com/splunk/security_content/blob/develop/macros/process_gpupdate.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_gpupdate](https://github.com/splunk/security_content/blob/develop/macros/process_gpupdate.yml) -Note that **suspicious_gpupdate_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_gpupdate_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ Limited false positives may be present in small environments. Tuning may be requ | 49.0 | 70 | 70 | Suspicious gpupdate.exe process with no command line arguments executed on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile](https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile) diff --git a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md index 591c803093..6632c5739d 100644 --- a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md @@ -1,6 +1,6 @@ --- title: "Suspicious Rundll32 no Command Line Arguments" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Rundll32 " categories: @@ -9,7 +9,7 @@ last_modified_at: 2022-03-15 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Rundll32 - Defense Evasion - Defense Evasion @@ -46,7 +46,7 @@ The following analytic identifies rundll32.exe with no command line arguments. I | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | @@ -104,7 +104,7 @@ The following analytic identifies rundll32.exe with no command line arguments. I -#### Search +#### Search ``` @@ -118,11 +118,12 @@ The following analytic identifies rundll32.exe with no command line arguments. I #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -Note that **suspicious_rundll32_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_rundll32_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -160,6 +161,9 @@ Although unlikely, some legitimate applications may use a moved copy of rundll32 | 49.0 | 70 | 70 | Suspicious rundll32.exe process with no command line arguments executed on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/) diff --git a/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md index 541275de48..376f289a41 100644 --- a/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md @@ -90,7 +90,7 @@ The following analytic identifies searchprotocolhost.exe with no command line ar -#### Search +#### Search ``` @@ -107,7 +107,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **suspicious_searchprotocolhost_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_searchprotocolhost_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ Limited false positives may be present in small environments. Tuning may be requ | 49.0 | 70 | 70 | Suspicious searchprotocolhost.exe process with no command line arguments executed on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc](https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc) diff --git a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md index 1232e06514..5af39a69f0 100644 --- a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md +++ b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md @@ -1,7 +1,7 @@ --- title: "Windows InstallUtil Remote Network Connection" excerpt: "InstallUtil -, Signed Binary Proxy Execution +, System Binary Proxy Execution " categories: - Endpoint @@ -10,7 +10,7 @@ toc: true toc_label: "" tags: - InstallUtil - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Defense Evasion - Defense Evasion - Splunk Enterprise @@ -50,7 +50,7 @@ During triage review resulting network connections, file modifications, and para | -------------- | ---------------- |-------------------- | | [T1218.004](https://attack.mitre.org/techniques/T1218/004/) | InstallUtil | Defense Evasion | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | @@ -97,7 +97,7 @@ During triage review resulting network connections, file modifications, and para -#### Search +#### Search ``` @@ -115,11 +115,12 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) -Note that **windows_installutil_remote_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_installutil_remote_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -159,6 +160,9 @@ Limited false positives should be present as InstallUtil is not typically used t | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ generating a remote download. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md) diff --git a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md index ec921623af..f2726ec07a 100644 --- a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md +++ b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md @@ -1,7 +1,7 @@ --- title: "Windows InstallUtil Uninstall Option with Network" excerpt: "InstallUtil -, Signed Binary Proxy Execution +, System Binary Proxy Execution " categories: - Endpoint @@ -10,7 +10,7 @@ toc: true toc_label: "" tags: - InstallUtil - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Defense Evasion - Defense Evasion - Splunk Enterprise @@ -51,7 +51,7 @@ During triage review resulting network connections, file modifications, and para | -------------- | ---------------- |-------------------- | | [T1218.004](https://attack.mitre.org/techniques/T1218/004/) | InstallUtil | Defense Evasion | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | @@ -98,7 +98,7 @@ During triage review resulting network connections, file modifications, and para -#### Search +#### Search ``` @@ -116,11 +116,12 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) -Note that **windows_installutil_uninstall_option_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_installutil_uninstall_option_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -160,6 +161,9 @@ Limited false positives should be present as InstallUtil is not typically used t | 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing an uninstall. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12](https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12) diff --git a/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md b/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md index dba137907b..0faa82a6ea 100644 --- a/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md +++ b/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md @@ -89,7 +89,7 @@ This analytic identifies suspicious modification of ACL permission to a files or -#### Search +#### Search ``` @@ -105,7 +105,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **modify_acl_permission_to_files_or_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **modify_acl_permission_to_files_or_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,6 +137,9 @@ administrators may use this command. Filter as needed. | 32.0 | 40 | 80 | Suspicious ACL permission modification on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/) diff --git a/docs/_posts/2022-03-22-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2022-03-22-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md index 0d176faa6b..3ce18c0108 100644 --- a/docs/_posts/2022-03-22-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md @@ -88,7 +88,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 ScriptBlockText ="*Get-ADDefaultDomainPasswordPolicy*" @@ -103,7 +103,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,6 +133,9 @@ Administrators or power users may use this command for troubleshooting. | 9.0 | 30 | 30 | powershell process having commandline $Message$ to query domain password policy | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet) diff --git a/docs/_posts/2022-03-22-get_domainuser_with_powershell_script_block.md b/docs/_posts/2022-03-22-get_domainuser_with_powershell_script_block.md index 41c8ebf5a7..ebd3d9a408 100644 --- a/docs/_posts/2022-03-22-get_domainuser_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-get_domainuser_with_powershell_script_block.md @@ -93,7 +93,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 ScriptBlockText = "*Get-DomainUser*" @@ -108,7 +108,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **get_domainuser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **get_domainuser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ Administrators or power users may use this command for troubleshooting. | 25.0 | 50 | 50 | powershell process having commandline $Message$ for user enumeration | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/](https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/) diff --git a/docs/_posts/2022-03-22-get_wmiobject_group_discovery_with_script_block_logging.md b/docs/_posts/2022-03-22-get_wmiobject_group_discovery_with_script_block_logging.md index 08d7008eb5..2f2d286712 100644 --- a/docs/_posts/2022-03-22-get_wmiobject_group_discovery_with_script_block_logging.md +++ b/docs/_posts/2022-03-22-get_wmiobject_group_discovery_with_script_block_logging.md @@ -95,7 +95,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It -#### Search +#### Search ``` `powershell` EventCode=4104 ScriptBlockText = "*Get-WMIObject*" AND ScriptBlockText = "*Win32_Group*" @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **get_wmiobject_group_discovery_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **get_wmiobject_group_discovery_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,6 +140,9 @@ False positives may be present. Tune as needed. | 15.0 | 30 | 50 | System group discovery enumeration on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.splunk.com/en_us/blog/security/powershell-detections-threat-research-release-august-2021.html](https://www.splunk.com/en_us/blog/security/powershell-detections-threat-research-release-august-2021.html) diff --git a/docs/_posts/2022-03-22-getadgroup_with_powershell_script_block.md b/docs/_posts/2022-03-22-getadgroup_with_powershell_script_block.md index 4273a8054f..965d28a485 100644 --- a/docs/_posts/2022-03-22-getadgroup_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-getadgroup_with_powershell_script_block.md @@ -93,7 +93,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 ScriptBlockText = "*Get-ADGroup*" @@ -108,7 +108,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **getadgroup_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **getadgroup_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo | 15.0 | 30 | 50 | Domain group discovery enumeration using PowerShell on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/) diff --git a/docs/_posts/2022-03-22-getcurrent_user_with_powershell_script_block.md b/docs/_posts/2022-03-22-getcurrent_user_with_powershell_script_block.md index 6f20c8cb99..0d48777b51 100644 --- a/docs/_posts/2022-03-22-getcurrent_user_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-getcurrent_user_with_powershell_script_block.md @@ -88,7 +88,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 ScriptBlockText = "*[System.Security.Principal.WindowsIdentity]*" ScriptBlockText = "*GetCurrent()*" @@ -103,7 +103,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **getcurrent_user_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **getcurrent_user_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,6 +135,9 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo | 15.0 | 30 | 50 | System user discovery on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1033/](https://attack.mitre.org/techniques/T1033/) diff --git a/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md b/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md index bbbc30c926..527557d29e 100644 --- a/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md @@ -93,7 +93,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 (ScriptBlockText = "*Get-LocalUser*") @@ -108,7 +108,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **getlocaluser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **getlocaluser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,6 +134,9 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo | 15.0 | 30 | 50 | Local user discovery enumeration using PowerShell on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1087/001/](https://attack.mitre.org/techniques/T1087/001/) diff --git a/docs/_posts/2022-03-22-interactive_session_on_remote_endpoint_with_powershell.md b/docs/_posts/2022-03-22-interactive_session_on_remote_endpoint_with_powershell.md index f147eb4867..36cad457f3 100644 --- a/docs/_posts/2022-03-22-interactive_session_on_remote_endpoint_with_powershell.md +++ b/docs/_posts/2022-03-22-interactive_session_on_remote_endpoint_with_powershell.md @@ -93,7 +93,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 (ScriptBlockText="*Enter-PSSession*" AND ScriptBlockText="*-ComputerName*") @@ -108,7 +108,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **interactive_session_on_remote_endpoint_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **interactive_session_on_remote_endpoint_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ Administrators may leverage WinRM and `Enter-PSSession` for administrative and t | 45.0 | 90 | 50 | An interactive session was opened on a remote endpoint from $ComputerName | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1021/006/](https://attack.mitre.org/techniques/T1021/006/) diff --git a/docs/_posts/2022-03-22-kerberos_pre-authentication_flag_disabled_with_powershell.md b/docs/_posts/2022-03-22-kerberos_pre-authentication_flag_disabled_with_powershell.md index 7641782d69..9e7b1b8814 100644 --- a/docs/_posts/2022-03-22-kerberos_pre-authentication_flag_disabled_with_powershell.md +++ b/docs/_posts/2022-03-22-kerberos_pre-authentication_flag_disabled_with_powershell.md @@ -93,7 +93,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 (ScriptBlockText = "*Set-ADAccountControl*" AND ScriptBlockText="*DoesNotRequirePreAuth:$true*") @@ -108,7 +108,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **kerberos_pre-authentication_flag_disabled_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **kerberos_pre-authentication_flag_disabled_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,6 +134,9 @@ Although unlikely, Administrators may need to set this flag for legitimate purpo | 45.0 | 50 | 90 | Kerberos Pre Authentication was Disabled using PowerShell on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties](https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties) diff --git a/docs/_posts/2022-03-22-powershell_execute_com_object.md b/docs/_posts/2022-03-22-powershell_execute_com_object.md index 8609d6aed5..bac913b29c 100644 --- a/docs/_posts/2022-03-22-powershell_execute_com_object.md +++ b/docs/_posts/2022-03-22-powershell_execute_com_object.md @@ -96,7 +96,7 @@ This search is to detect a COM CLSID execution through powershell. This techniqu -#### Search +#### Search ``` `powershell` EventCode=4104 ScriptBlockText = "*CreateInstance([type]::GetTypeFromCLSID*" @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **powershell_execute_com_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **powershell_execute_com_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ network operrator may use this command. | 5.0 | 10 | 50 | A suspicious powershell script contains COM CLSID command in $Message$ with EventCode $EventCode$ in host $ComputerName$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://threadreaderapp.com/thread/1423361119926816776.html](https://threadreaderapp.com/thread/1423361119926816776.html) diff --git a/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md b/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md index 931abbd188..26b6b3ace2 100644 --- a/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md +++ b/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md @@ -93,7 +93,7 @@ The following analytic identifies suspicious PowerShell script execution via Eve -#### Search +#### Search ``` `powershell` EventCode=4104 ScriptBlockText = *New-Object* ScriptBlockText = *IO.MemoryStream* @@ -108,7 +108,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **powershell_using_memory_as_backing_store_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **powershell_using_memory_as_backing_store_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ powershell may used this function to store out object into memory. | 40.0 | 50 | 80 | A suspicious powershell script contains memorystream command in $Message$ as new object backstore with EventCode $EventCode$ in host $ComputerName$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.carbonblack.com/blog/decoding-malicious-powershell-streams/](https://www.carbonblack.com/blog/decoding-malicious-powershell-streams/) diff --git a/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md b/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md index 06996b1caf..02ccb1e84b 100644 --- a/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md +++ b/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md @@ -88,7 +88,7 @@ The following analytic identifies suspicious PowerShell script execution via Eve -#### Search +#### Search ``` `powershell` EventCode=4104 (ScriptBlockText = "*SELECT*" OR ScriptBlockText = "*WMIC*") AND (ScriptBlockText = "*AntiVirusProduct*" OR ScriptBlockText = "*AntiSpywareProduct*") @@ -103,7 +103,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **recon_avproduct_through_pwh_or_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **recon_avproduct_through_pwh_or_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,6 +135,9 @@ network administrator may used this command for checking purposes | 56.0 | 70 | 80 | A suspicious powershell script contains AV recon command in $Message$ with EventCode $EventCode$ in host $ComputerName$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/](https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/) diff --git a/docs/_posts/2022-03-22-remote_process_instantiation_via_dcom_and_powershell_script_block.md b/docs/_posts/2022-03-22-remote_process_instantiation_via_dcom_and_powershell_script_block.md index 16660ad286..924c75c66b 100644 --- a/docs/_posts/2022-03-22-remote_process_instantiation_via_dcom_and_powershell_script_block.md +++ b/docs/_posts/2022-03-22-remote_process_instantiation_via_dcom_and_powershell_script_block.md @@ -93,7 +93,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 (ScriptBlockText="*Document.Application.ShellExecute*" OR ScriptBlockText="*Document.ActiveView.ExecuteShellCommand*") @@ -108,7 +108,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **remote_process_instantiation_via_dcom_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **remote_process_instantiation_via_dcom_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ Administrators may leverage DCOM to start a process on remote systems, but this | 63.0 | 90 | 70 | A process was started on a remote endpoint from $ComputerName by abusing WMI using PowerShell.exe | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1021/003/](https://attack.mitre.org/techniques/T1021/003/) diff --git a/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md b/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md index e2d3ee3984..4c6450c0f6 100644 --- a/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md +++ b/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md @@ -93,7 +93,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 (ScriptBlockText="*Invoke-Command*" AND ScriptBlockText="*-ComputerName*") @@ -108,7 +108,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **remote_process_instantiation_via_winrm_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **remote_process_instantiation_via_winrm_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,6 +138,9 @@ Administrators may leverage WinRM and `Invoke-Command` to start a process on rem | 45.0 | 90 | 50 | A process was started on a remote endpoint from $ComputerName by abusing WinRM using PowerShell.exe | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1021/006/](https://attack.mitre.org/techniques/T1021/006/) diff --git a/docs/_posts/2022-03-22-user_discovery_with_env_vars_powershell_script_block.md b/docs/_posts/2022-03-22-user_discovery_with_env_vars_powershell_script_block.md index b510f4ed1e..e93bb7ff4e 100644 --- a/docs/_posts/2022-03-22-user_discovery_with_env_vars_powershell_script_block.md +++ b/docs/_posts/2022-03-22-user_discovery_with_env_vars_powershell_script_block.md @@ -88,7 +88,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 (ScriptBlockText = "*$env:UserName*" OR ScriptBlockText = "*[System.Environment]::UserName*") @@ -103,7 +103,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **user_discovery_with_env_vars_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **user_discovery_with_env_vars_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,6 +135,9 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo | 15.0 | 30 | 50 | System user discovery on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1033/](https://attack.mitre.org/techniques/T1033/) diff --git a/docs/_posts/2022-03-24-splunk_dos_via_malformed_s2s_request.md b/docs/_posts/2022-03-24-splunk_dos_via_malformed_s2s_request.md index 7b141d7d28..a1c1492e33 100644 --- a/docs/_posts/2022-03-24-splunk_dos_via_malformed_s2s_request.md +++ b/docs/_posts/2022-03-24-splunk_dos_via_malformed_s2s_request.md @@ -99,7 +99,7 @@ On March 24th, 2022, Splunk published a security advisory for a possible Denial -#### Search +#### Search ``` `splunkd` log_level="ERROR" component="TcpInputProc" thread_name="FwdDataReceiverThread" "Invalid _meta atom" @@ -111,7 +111,8 @@ On March 24th, 2022, Splunk published a security advisory for a possible Denial The SPL above uses the following Macros: * [splunkd](https://github.com/splunk/security_content/blob/develop/macros/splunkd.yml) -Note that **splunk_dos_via_malformed_s2s_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **splunk_dos_via_malformed_s2s_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * host @@ -140,6 +141,9 @@ None. | 50.0 | 50 | 100 | An attempt to exploit CVE-2021-3422 was detected from $src$ against $host$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html](https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html) diff --git a/docs/_posts/2022-03-28-sql_injection_with_long_urls.md b/docs/_posts/2022-03-28-sql_injection_with_long_urls.md index 2b1d23bd8d..b69ee2b4c7 100644 --- a/docs/_posts/2022-03-28-sql_injection_with_long_urls.md +++ b/docs/_posts/2022-03-28-sql_injection_with_long_urls.md @@ -16,7 +16,7 @@ tags: - Web --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -101,7 +101,7 @@ This search looks for long URLs that have several SQL commands visible within th -#### Search +#### Search ``` @@ -117,7 +117,8 @@ This search looks for long URLs that have several SQL commands visible within th The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **sql_injection_with_long_urls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **sql_injection_with_long_urls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ It's possible that legitimate traffic will have long URLs or long user agent str | 25.0 | 50 | 50 | SQL injection attempt with url $url$ detected on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2022-03-28-windows_deleted_registry_by_a_non_critical_process_file_path.md b/docs/_posts/2022-03-28-windows_deleted_registry_by_a_non_critical_process_file_path.md index 588343ce97..58ed5b3bd2 100644 --- a/docs/_posts/2022-03-28-windows_deleted_registry_by_a_non_critical_process_file_path.md +++ b/docs/_posts/2022-03-28-windows_deleted_registry_by_a_non_critical_process_file_path.md @@ -93,7 +93,7 @@ This analytic is to detect deletion of registry with suspicious process file pat -#### Search +#### Search ``` @@ -113,7 +113,8 @@ This analytic is to detect deletion of registry with suspicious process file pat The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_deleted_registry_by_a_non_critical_process_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_deleted_registry_by_a_non_critical_process_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,6 +153,9 @@ This detection can catch for third party application updates or installation. In | 36.0 | 60 | 60 | registry was deleted by a suspicious $process_name$ with proces path $process_path in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html](https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html) diff --git a/docs/_posts/2022-03-28-windows_get-adcomputer_unconstrained_delegation_discovery.md b/docs/_posts/2022-03-28-windows_get-adcomputer_unconstrained_delegation_discovery.md index a5ef307ea5..cc8fa441a4 100644 --- a/docs/_posts/2022-03-28-windows_get-adcomputer_unconstrained_delegation_discovery.md +++ b/docs/_posts/2022-03-28-windows_get-adcomputer_unconstrained_delegation_discovery.md @@ -94,7 +94,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 (Message = "*Get-ADComputer*" AND Message = "*TrustedForDelegation*") @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **windows_get-adcomputer_unconstrained_delegation_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_get-adcomputer_unconstrained_delegation_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ Administrators or power users may leverage PowerView for system management or tr | 35.0 | 50 | 70 | Suspicious PowerShell Get-ADComputer was identified on endpoint $ComputerName$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2022-03-28-windows_powerview_unconstrained_delegation_discovery.md b/docs/_posts/2022-03-28-windows_powerview_unconstrained_delegation_discovery.md index 4dbeb79ec8..c0fd8843c9 100644 --- a/docs/_posts/2022-03-28-windows_powerview_unconstrained_delegation_discovery.md +++ b/docs/_posts/2022-03-28-windows_powerview_unconstrained_delegation_discovery.md @@ -94,7 +94,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 (Message = "*Get-DomainComputer*" OR Message = "*Get-NetComputer*") AND (Message = "*-Unconstrained*") @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **windows_powerview_unconstrained_delegation_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_powerview_unconstrained_delegation_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ Administrators or power users may leverage PowerView for system management or tr | 35.0 | 50 | 70 | Suspicious PowerShell Get-DomainComputer was identified on endpoint $ComputerName$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2022-03-28-windows_terminating_lsass_process.md b/docs/_posts/2022-03-28-windows_terminating_lsass_process.md index 15d2c627d0..237644f35a 100644 --- a/docs/_posts/2022-03-28-windows_terminating_lsass_process.md +++ b/docs/_posts/2022-03-28-windows_terminating_lsass_process.md @@ -98,7 +98,7 @@ This analytic is to detect a suspicious process terminating Lsass process. Lsass -#### Search +#### Search ``` `sysmon` EventCode=10 TargetImage=*lsass.exe GrantedAccess = 0x1 @@ -114,7 +114,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **windows_terminating_lsass_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_terminating_lsass_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ unknown | 64.0 | 80 | 80 | a process $SourceImage$ terminates Lsass process in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html](https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html) diff --git a/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md b/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md index 43724d2dec..116921f099 100644 --- a/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md +++ b/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md @@ -110,7 +110,7 @@ The following analytic identifies the use of a delivered ISO file that has been -#### Search +#### Search ``` @@ -126,7 +126,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_iso_lnk_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_iso_lnk_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Filesystem.file_create_time @@ -155,6 +156,9 @@ False positives may be high depending on the environment and consistent use of I | 40.0 | 80 | 50 | An ISO file was mounted on $dest$ and should be reviewed and filtered as needed. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/](https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/) diff --git a/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md b/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md index 817547d634..d007d1698a 100644 --- a/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md +++ b/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md @@ -100,7 +100,7 @@ The following analytic assists with viewing all drivers being loaded by using Sy -#### Search +#### Search ``` `sysmon` EventCode=6 @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **windows_drivers_loaded_by_signature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_drivers_loaded_by_signature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ This analytic is meant to assist with identifying drivers loaded in the environm | 42.0 | 60 | 70 | A driver has loaded on $Computer$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/](https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/) diff --git a/docs/_posts/2022-03-31-windows_powerview_constrained_delegation_discovery.md b/docs/_posts/2022-03-31-windows_powerview_constrained_delegation_discovery.md index 6de1da6718..f9c743cfc9 100644 --- a/docs/_posts/2022-03-31-windows_powerview_constrained_delegation_discovery.md +++ b/docs/_posts/2022-03-31-windows_powerview_constrained_delegation_discovery.md @@ -94,7 +94,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 (Message = "*Get-DomainComputer*" OR Message = "*Get-NetComputer*") AND (Message = "*-TrustedToAuth*") @@ -109,7 +109,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **windows_powerview_constrained_delegation_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_powerview_constrained_delegation_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,6 +139,9 @@ Administrators or power users may leverage PowerView for system management or tr | 35.0 | 50 | 70 | Suspicious PowerShell Get-DomainComputer was identified on endpoint $ComputerName$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/) diff --git a/docs/_posts/2022-03-31-windows_registry_certificate_added.md b/docs/_posts/2022-03-31-windows_registry_certificate_added.md index 39e850dfb7..5c77608aa7 100644 --- a/docs/_posts/2022-03-31-windows_registry_certificate_added.md +++ b/docs/_posts/2022-03-31-windows_registry_certificate_added.md @@ -100,7 +100,7 @@ The following analytic identifies installation of a root CA certificate by monit -#### Search +#### Search ``` @@ -117,7 +117,8 @@ The following analytic identifies installation of a root CA certificate by monit The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_registry_certificate_added_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_registry_certificate_added_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,6 +153,9 @@ False positives will be limited to a legitimate business applicating consistentl | 42.0 | 60 | 70 | A root certificate was added on $dest$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec](https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec) diff --git a/docs/_posts/2022-03-31-windows_registry_modification_for_safe_mode_persistence.md b/docs/_posts/2022-03-31-windows_registry_modification_for_safe_mode_persistence.md index 8834dea621..6a1548f2a6 100644 --- a/docs/_posts/2022-03-31-windows_registry_modification_for_safe_mode_persistence.md +++ b/docs/_posts/2022-03-31-windows_registry_modification_for_safe_mode_persistence.md @@ -96,7 +96,7 @@ The following analytic identifies a modification or registry add to the safeboot -#### Search +#### Search ``` @@ -113,7 +113,8 @@ The following analytic identifies a modification or registry add to the safeboot The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_registry_modification_for_safe_mode_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_registry_modification_for_safe_mode_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,6 +150,9 @@ updated windows application needed in safe boot may used this registry | 42.0 | 60 | 70 | Safeboot registry $registry_path$ was added or modified with a new value $registry_value_name$ on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://malware.news/t/threat-analysis-unit-tau-threat-intelligence-notification-snatch-ransomware/36365](https://malware.news/t/threat-analysis-unit-tau-threat-intelligence-notification-snatch-ransomware/36365) diff --git a/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md b/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md index 251884b115..de38e044db 100644 --- a/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md +++ b/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md @@ -99,7 +99,7 @@ This search detects a disabled security workflow in GitHub Actions. An attacker -#### Search +#### Search ``` `github` workflow_run.event=push OR workflow_run.event=pull_request @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) -Note that **github_actions_disable_security_workflow_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **github_actions_disable_security_workflow_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * workflow_run.event @@ -152,6 +153,9 @@ unknown | 27.0 | 30 | 90 | Security Workflow is disabled in branch $branch$ for repository $repository$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html](https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html) diff --git a/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md b/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md index a1c428931a..432c7616b9 100644 --- a/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md +++ b/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md @@ -95,7 +95,7 @@ The following analytic uses Windows EventCode 7045 to identify new Kernel Mode D -#### Search +#### Search ``` `wineventlog_system` EventCode=7045 Service_Type="kernel mode driver" NOT (Service_File_Name IN ("*\\Windows\\*", "*\\Program File*", "*\\systemroot\\*","%SystemRoot%*", "system32\*")) @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) -Note that **windows_driver_load_non-standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_driver_load_non-standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * ComputerName @@ -140,6 +141,9 @@ False positives may be present based on legitimate third party applications need | 36.0 | 60 | 60 | A kernel mode driver was loaded from a non-standard path on $ComputerName$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/](https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/) diff --git a/docs/_posts/2022-04-04-windows_event_for_service_disabled.md b/docs/_posts/2022-04-04-windows_event_for_service_disabled.md index 2ff0a2dd67..8cf80a667b 100644 --- a/docs/_posts/2022-04-04-windows_event_for_service_disabled.md +++ b/docs/_posts/2022-04-04-windows_event_for_service_disabled.md @@ -100,7 +100,7 @@ This analytic will identify suspicious system event of services that was modifie -#### Search +#### Search ``` `wineventlog_system` EventCode=7040 Message = "*service was changed from demand start to disabled." @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) -Note that **windows_event_for_service_disabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_event_for_service_disabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ Windows service update may cause this event. In that scenario, filtering is need | 36.0 | 60 | 60 | Service was disabled on $Computer$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://blog.talosintelligence.com/2018/02/olympic-destroyer.html](https://blog.talosintelligence.com/2018/02/olympic-destroyer.html) diff --git a/docs/_posts/2022-04-05-java_writing_jsp_file.md b/docs/_posts/2022-04-05-java_writing_jsp_file.md index 987986d996..6ac6199a03 100644 --- a/docs/_posts/2022-04-05-java_writing_jsp_file.md +++ b/docs/_posts/2022-04-05-java_writing_jsp_file.md @@ -100,7 +100,7 @@ The following analytic identifies the process java writing a .jsp to disk. This -#### Search +#### Search ``` @@ -121,7 +121,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **java_writing_jsp_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **java_writing_jsp_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -163,6 +164,9 @@ False positives are possible and filtering may be required. Restrict by assets o | 42.0 | 60 | 70 | An instance of $process_name$ was identified on endpoint $dest$ writing a jsp file to disk, potentially indicative of exploitation. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/](https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/) diff --git a/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md b/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md index a14ceaa86d..806039a2f6 100644 --- a/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md +++ b/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md @@ -19,7 +19,7 @@ tags: - Endpoint --- -### WARNING THIS IS A EXPERIMENTAL object +### :warning: WARNING THIS IS A EXPERIMENTAL analytic We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. @@ -102,7 +102,7 @@ This analytic looks for suspicious commandline that redirect the stdout or possi -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_stdout_redirection_to_dev_null_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_stdout_redirection_to_dev_null_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ unknown | 36.0 | 60 | 60 | a commandline $process$ that redirect stdout to dev/null in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf](https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf) diff --git a/docs/_posts/2022-04-05-spring4shell_payload_url_request.md b/docs/_posts/2022-04-05-spring4shell_payload_url_request.md index 9e8e63b4a7..42271ed031 100644 --- a/docs/_posts/2022-04-05-spring4shell_payload_url_request.md +++ b/docs/_posts/2022-04-05-spring4shell_payload_url_request.md @@ -110,7 +110,7 @@ The following analytic is static indicators related to CVE-2022-22963, Spring4Sh -#### Search +#### Search ``` @@ -125,7 +125,8 @@ The following analytic is static indicators related to CVE-2022-22963, Spring4Sh The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **spring4shell_payload_url_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **spring4shell_payload_url_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -156,6 +157,9 @@ The jsp file names are static names used in current proof of concept code. = | 36.0 | 60 | 60 | A URL was requested related to Spring4Shell POC code on $dest$ by $src$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/](https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/) diff --git a/docs/_posts/2022-04-05-web_jsp_request_via_url.md b/docs/_posts/2022-04-05-web_jsp_request_via_url.md index e95fde1701..d3edad7bf0 100644 --- a/docs/_posts/2022-04-05-web_jsp_request_via_url.md +++ b/docs/_posts/2022-04-05-web_jsp_request_via_url.md @@ -110,7 +110,7 @@ The following analytic identifies the common URL requests used by a recent CVE - -#### Search +#### Search ``` @@ -125,7 +125,8 @@ The following analytic identifies the common URL requests used by a recent CVE - The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **web_jsp_request_via_url_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **web_jsp_request_via_url_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -156,6 +157,9 @@ False positives may be present with legitimate applications. Attempt to filter b | 72.0 | 90 | 80 | A suspicious URL has been requested against $dest$ by $src$, related to web shell activity. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/](https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/) diff --git a/docs/_posts/2022-04-05-web_spring_cloud_function_functionrouter.md b/docs/_posts/2022-04-05-web_spring_cloud_function_functionrouter.md index cac68e4e0e..233ffda28a 100644 --- a/docs/_posts/2022-04-05-web_spring_cloud_function_functionrouter.md +++ b/docs/_posts/2022-04-05-web_spring_cloud_function_functionrouter.md @@ -100,7 +100,7 @@ The following analytic identifies activity related to the web application Spring -#### Search +#### Search ``` @@ -115,7 +115,8 @@ The following analytic identifies activity related to the web application Spring The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **web_spring_cloud_function_functionrouter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **web_spring_cloud_function_functionrouter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ False positives may be present with legitimate applications. Attempt to filter b | 42.0 | 70 | 60 | A suspicious URL has been requested against $dest$ by $src$, related to a vulnerability in Spring Cloud. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/rapid7/metasploit-framework/pull/16395](https://github.com/rapid7/metasploit-framework/pull/16395) diff --git a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md index 09293e9ce1..78d817612d 100644 --- a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md +++ b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md @@ -94,7 +94,7 @@ The following analytic detects programs that have been started by forfiles.exe. -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_indirect_command_execution_via_forfiles_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_indirect_command_execution_via_forfiles_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ Some legacy applications may be run using pcalua.exe. Similarly, forfiles.exe ma | 25.0 | 50 | 50 | The Program Compatability Assistant (pcalua.exe) launched the process $process_name$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://twitter.com/KyleHanslovan/status/912659279806640128](https://twitter.com/KyleHanslovan/status/912659279806640128) diff --git a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md index 7a396cf4c8..f4868dfd77 100644 --- a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md +++ b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md @@ -94,7 +94,7 @@ The following analytic detects programs that have been started by pcalua.exe. pc -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_indirect_command_execution_via_pcalua_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_indirect_command_execution_via_pcalua_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ Some legacy applications may be run using pcalua.exe. Filter these results as n | 25.0 | 50 | 50 | The Program Compatability Assistant (pcalua.exe) launched the process $process_name$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://twitter.com/KyleHanslovan/status/912659279806640128](https://twitter.com/KyleHanslovan/status/912659279806640128) diff --git a/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md b/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md index fc3f33faee..cd549f68af 100644 --- a/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md +++ b/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md @@ -100,7 +100,7 @@ The following analytic identifies the payload related to Spring4Shell, CVE-2022- -#### Search +#### Search ``` `stream_http` http_method IN ("POST") @@ -113,10 +113,11 @@ The following analytic identifies the payload related to Spring4Shell, CVE-2022- #### Macros The SPL above uses the following Macros: -* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) -Note that **web_spring4shell_http_request_class_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **web_spring4shell_http_request_class_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,6 +149,9 @@ False positives may occur and filtering may be required. Restrict analytic to as | 72.0 | 90 | 80 | A http body request related to Spring4Shell has been sent to $dest$ by $src$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/DDuarte/springshell-rce-poc/blob/master/poc.py](https://github.com/DDuarte/springshell-rce-poc/blob/master/poc.py) diff --git a/docs/_posts/2022-04-07-any_powershell_downloadfile.md b/docs/_posts/2022-04-07-any_powershell_downloadfile.md index aa4497edb3..b02836c531 100644 --- a/docs/_posts/2022-04-07-any_powershell_downloadfile.md +++ b/docs/_posts/2022-04-07-any_powershell_downloadfile.md @@ -104,7 +104,7 @@ The following analytic identifies the use of PowerShell downloading a file using -#### Search +#### Search ``` @@ -121,7 +121,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -Note that **any_powershell_downloadfile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **any_powershell_downloadfile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -160,6 +161,9 @@ False positives may be present and filtering will need to occur by parent proces | 56.0 | 80 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile within PowerShell. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0](https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0) diff --git a/docs/_posts/2022-04-07-any_powershell_downloadstring.md b/docs/_posts/2022-04-07-any_powershell_downloadstring.md index 18baa12ae8..7988f34158 100644 --- a/docs/_posts/2022-04-07-any_powershell_downloadstring.md +++ b/docs/_posts/2022-04-07-any_powershell_downloadstring.md @@ -99,7 +99,7 @@ The following analytic identifies the use of PowerShell downloading a file using -#### Search +#### Search ``` @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -Note that **any_powershell_downloadstring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **any_powershell_downloadstring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -155,6 +156,9 @@ False positives may be present and filtering will need to occur by parent proces | 56.0 | 80 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadString within PowerShell. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-5.0](https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-5.0) diff --git a/docs/_posts/2022-04-07-detect_html_help_renamed.md b/docs/_posts/2022-04-07-detect_html_help_renamed.md index 8705216b5b..6fa7a8e582 100644 --- a/docs/_posts/2022-04-07-detect_html_help_renamed.md +++ b/docs/_posts/2022-04-07-detect_html_help_renamed.md @@ -1,6 +1,6 @@ --- title: "Detect HTML Help Renamed" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Compiled HTML File " categories: @@ -9,7 +9,7 @@ last_modified_at: 2022-04-07 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Compiled HTML File - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ The following analytic identifies a renamed instance of hh.exe (HTML Help) execu | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.001](https://attack.mitre.org/techniques/T1218/001/) | Compiled HTML File | Defense Evasion | @@ -99,7 +99,7 @@ The following analytic identifies a renamed instance of hh.exe (HTML Help) execu -#### Search +#### Search ``` @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_html_help_renamed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_html_help_renamed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,6 +153,9 @@ Although unlikely a renamed instance of hh.exe will be used legitimately, filter | 80.0 | 80 | 100 | The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1218/001/](https://attack.mitre.org/techniques/T1218/001/) diff --git a/docs/_posts/2022-04-07-detect_mshta_renamed.md b/docs/_posts/2022-04-07-detect_mshta_renamed.md index 72323a52e2..93eece1173 100644 --- a/docs/_posts/2022-04-07-detect_mshta_renamed.md +++ b/docs/_posts/2022-04-07-detect_mshta_renamed.md @@ -1,6 +1,6 @@ --- title: "Detect mshta renamed" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Mshta " categories: @@ -9,7 +9,7 @@ last_modified_at: 2022-04-07 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Mshta - Defense Evasion - Defense Evasion @@ -45,7 +45,7 @@ The following analytic identifies renamed instances of mshta.exe executing. Msht | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | @@ -99,7 +99,7 @@ The following analytic identifies renamed instances of mshta.exe executing. Msht -#### Search +#### Search ``` @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_mshta_renamed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_mshta_renamed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,6 +153,9 @@ Although unlikely, some legitimate applications may use a moved copy of mshta.ex | 80.0 | 80 | 100 | The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/AtomicTestHarnesses](https://github.com/redcanaryco/AtomicTestHarnesses) diff --git a/docs/_posts/2022-04-07-detect_renamed_psexec.md b/docs/_posts/2022-04-07-detect_renamed_psexec.md index 470e84cec8..eed5b86c86 100644 --- a/docs/_posts/2022-04-07-detect_renamed_psexec.md +++ b/docs/_posts/2022-04-07-detect_renamed_psexec.md @@ -94,7 +94,7 @@ The following analytic identifies renamed instances of `PsExec.exe` being utiliz -#### Search +#### Search ``` @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **detect_renamed_psexec_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_renamed_psexec_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,6 +151,9 @@ Limited false positives should be present. It is possible some third party appli | 27.0 | 30 | 90 | The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.002/T1569.002.yaml](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.002/T1569.002.yaml) diff --git a/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md b/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md index 7f817af8e1..1e29bd1de9 100644 --- a/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md +++ b/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md @@ -104,7 +104,7 @@ The following analytic identifies a renamed instance of microsoft.workflow.compi -#### Search +#### Search ``` @@ -120,7 +120,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **suspicious_microsoft_workflow_compiler_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_microsoft_workflow_compiler_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -159,6 +160,9 @@ Although unlikely, some legitimate applications may use a moved copy of microsof | 63.0 | 70 | 90 | Suspicious renamed microsoft.workflow.compiler.exe binary ran on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/](https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/) diff --git a/docs/_posts/2022-04-07-suspicious_msbuild_rename.md b/docs/_posts/2022-04-07-suspicious_msbuild_rename.md index 6dea2cf889..b9eaddb521 100644 --- a/docs/_posts/2022-04-07-suspicious_msbuild_rename.md +++ b/docs/_posts/2022-04-07-suspicious_msbuild_rename.md @@ -109,7 +109,7 @@ The following analytic identifies renamed instances of msbuild.exe executing. Ms -#### Search +#### Search ``` @@ -125,7 +125,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **suspicious_msbuild_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_msbuild_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -164,6 +165,9 @@ Although unlikely, some legitimate applications may use a moved copy of msbuild, | 63.0 | 70 | 90 | Suspicious renamed msbuild.exe binary ran on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://lolbas-project.github.io/lolbas/Binaries/Msbuild/](https://lolbas-project.github.io/lolbas/Binaries/Msbuild/) diff --git a/docs/_posts/2022-04-07-suspicious_rundll32_rename.md b/docs/_posts/2022-04-07-suspicious_rundll32_rename.md index 7d8d33af65..91c0e3235e 100644 --- a/docs/_posts/2022-04-07-suspicious_rundll32_rename.md +++ b/docs/_posts/2022-04-07-suspicious_rundll32_rename.md @@ -1,6 +1,6 @@ --- title: "Suspicious Rundll32 Rename" -excerpt: "Signed Binary Proxy Execution +excerpt: "System Binary Proxy Execution , Masquerading , Rundll32 , Rename System Utilities @@ -11,7 +11,7 @@ last_modified_at: 2022-04-07 toc: true toc_label: "" tags: - - Signed Binary Proxy Execution + - System Binary Proxy Execution - Masquerading - Rundll32 - Rename System Utilities @@ -51,7 +51,7 @@ The following hunting analytic identifies renamed instances of rundll32.exe exec | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | | [T1036](https://attack.mitre.org/techniques/T1036/) | Masquerading | Defense Evasion | @@ -109,7 +109,7 @@ The following hunting analytic identifies renamed instances of rundll32.exe exec -#### Search +#### Search ``` @@ -125,7 +125,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **suspicious_rundll32_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **suspicious_rundll32_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -162,6 +163,9 @@ Although unlikely, some legitimate applications may use a moved copy of rundll32 | 63.0 | 70 | 90 | Suspicious renamed rundll32.exe binary ran on $dest$ by $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/) diff --git a/docs/_posts/2022-04-12-linux_account_manipulation_of_ssh_config_and_keys.md b/docs/_posts/2022-04-12-linux_account_manipulation_of_ssh_config_and_keys.md index b8b44b6042..b2e600187b 100644 --- a/docs/_posts/2022-04-12-linux_account_manipulation_of_ssh_config_and_keys.md +++ b/docs/_posts/2022-04-12-linux_account_manipulation_of_ssh_config_and_keys.md @@ -105,7 +105,7 @@ This analytic is to detect a deletion of ssh key in a linux machine. attacker ma -#### Search +#### Search ``` @@ -125,7 +125,8 @@ This analytic is to detect a deletion of ssh key in a linux machine. attacker ma The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_account_manipulation_of_ssh_config_and_keys_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_account_manipulation_of_ssh_config_and_keys_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -165,6 +166,9 @@ Administrator or network operator can execute this command. Please update the fi | 49.0 | 70 | 70 | a $process_name$ deleting a SSH key in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/](https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/) diff --git a/docs/_posts/2022-04-12-linux_deletion_of_cron_jobs.md b/docs/_posts/2022-04-12-linux_deletion_of_cron_jobs.md index 28be4f4d2d..2213e358ff 100644 --- a/docs/_posts/2022-04-12-linux_deletion_of_cron_jobs.md +++ b/docs/_posts/2022-04-12-linux_deletion_of_cron_jobs.md @@ -105,7 +105,7 @@ This analytic is to detect a deletion of cron job in a linux machine. This techn -#### Search +#### Search ``` @@ -125,7 +125,8 @@ This analytic is to detect a deletion of cron job in a linux machine. This techn The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_deletion_of_cron_jobs_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_deletion_of_cron_jobs_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -165,6 +166,9 @@ Administrator or network operator can execute this command. Please update the fi | 49.0 | 70 | 70 | a $process_name$ deleting cron jobs in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/](https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/) diff --git a/docs/_posts/2022-04-12-linux_deletion_of_init_daemon_script.md b/docs/_posts/2022-04-12-linux_deletion_of_init_daemon_script.md index ba364601b3..72aa55766c 100644 --- a/docs/_posts/2022-04-12-linux_deletion_of_init_daemon_script.md +++ b/docs/_posts/2022-04-12-linux_deletion_of_init_daemon_script.md @@ -105,7 +105,7 @@ This analytic is to detect a deletion of init daemon script in a linux machine. -#### Search +#### Search ``` @@ -125,7 +125,8 @@ This analytic is to detect a deletion of init daemon script in a linux machine. The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_deletion_of_init_daemon_script_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_deletion_of_init_daemon_script_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -165,6 +166,9 @@ Administrator or network operator can execute this command. Please update the fi | 49.0 | 70 | 70 | a $process_name$ deleting a daemon script in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/](https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/) diff --git a/docs/_posts/2022-04-12-linux_deletion_of_services.md b/docs/_posts/2022-04-12-linux_deletion_of_services.md index 95361256e4..acc51b94e3 100644 --- a/docs/_posts/2022-04-12-linux_deletion_of_services.md +++ b/docs/_posts/2022-04-12-linux_deletion_of_services.md @@ -105,7 +105,7 @@ This analytic is to detect a deletion of services in a linux machine. attacker m -#### Search +#### Search ``` @@ -125,7 +125,8 @@ This analytic is to detect a deletion of services in a linux machine. attacker m The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_deletion_of_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_deletion_of_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -165,6 +166,9 @@ Administrator or network operator can execute this command. Please update the fi | 64.0 | 80 | 80 | a $process_name$ deleting a services in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/](https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/) diff --git a/docs/_posts/2022-04-12-linux_deletion_of_ssl_certificate.md b/docs/_posts/2022-04-12-linux_deletion_of_ssl_certificate.md index eb9d1fc43c..ee2e06d8f2 100644 --- a/docs/_posts/2022-04-12-linux_deletion_of_ssl_certificate.md +++ b/docs/_posts/2022-04-12-linux_deletion_of_ssl_certificate.md @@ -105,7 +105,7 @@ This analytic is to detect a deletion of ssl certificate in a linux machine. att -#### Search +#### Search ``` @@ -125,7 +125,8 @@ This analytic is to detect a deletion of ssl certificate in a linux machine. att The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_deletion_of_ssl_certificate_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_deletion_of_ssl_certificate_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -165,6 +166,9 @@ Administrator or network operator can execute this command. Please update the fi | 49.0 | 70 | 70 | a $process_name$ deleting a SSL certificate in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/](https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/) diff --git a/docs/_posts/2022-04-12-linux_high_frequency_of_file_deletion_in_etc_folder.md b/docs/_posts/2022-04-12-linux_high_frequency_of_file_deletion_in_etc_folder.md index 93c519d104..2e881adcba 100644 --- a/docs/_posts/2022-04-12-linux_high_frequency_of_file_deletion_in_etc_folder.md +++ b/docs/_posts/2022-04-12-linux_high_frequency_of_file_deletion_in_etc_folder.md @@ -105,7 +105,7 @@ This analytic is to detect a high frequency of file deletion relative to process -#### Search +#### Search ``` @@ -126,7 +126,8 @@ This analytic is to detect a high frequency of file deletion relative to process The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_high_frequency_of_file_deletion_in_etc_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_high_frequency_of_file_deletion_in_etc_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -166,6 +167,9 @@ linux package installer/uninstaller may cause this event. Please update you filt | 49.0 | 70 | 70 | a $process_name$ deleting multiple files in /etc/ folder in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/](https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/) diff --git a/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md b/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md index 3fb122e254..d7f366b8a5 100644 --- a/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md +++ b/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md @@ -102,7 +102,7 @@ The following analytic identifies a process attempting to delete a scheduled tas -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_registry_delete_task_sd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_registry_delete_task_sd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,6 +154,9 @@ False positives should be limited as the activity is not common to delete ONLY t | 49.0 | 70 | 70 | A scheduled task security descriptor was deleted from the registry on $dest$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/](https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/) diff --git a/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md b/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md index d8f9f5ce60..8981efd6d9 100644 --- a/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md +++ b/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md @@ -94,7 +94,7 @@ This search looks for the execution of `nltest.exe` with command-line arguments -#### Search +#### Search ``` @@ -107,11 +107,12 @@ This search looks for the execution of `nltest.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [process_nltest](https://github.com/splunk/security_content/blob/develop/macros/process_nltest.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_nltest](https://github.com/splunk/security_content/blob/develop/macros/process_nltest.yml) -Note that **nltest_domain_trust_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **nltest_domain_trust_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ Administrators may use nltest for troubleshooting purposes, otherwise, rarely us | 15.0 | 30 | 50 | Domain trust discovery execution on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md) diff --git a/docs/_posts/2022-04-22-linux_adding_crontab_using_list_parameter.md b/docs/_posts/2022-04-22-linux_adding_crontab_using_list_parameter.md index aa9ce26469..7db1960454 100644 --- a/docs/_posts/2022-04-22-linux_adding_crontab_using_list_parameter.md +++ b/docs/_posts/2022-04-22-linux_adding_crontab_using_list_parameter.md @@ -104,7 +104,7 @@ The following analytic identifies a suspicious cron jobs modification using cron -#### Search +#### Search ``` @@ -120,7 +120,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_adding_crontab_using_list_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_adding_crontab_using_list_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -154,6 +155,9 @@ Administrator or network operator can use this application for automation purpos | 25.0 | 50 | 50 | A possible crontab list command $process$ executed on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/](https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/) diff --git a/docs/_posts/2022-04-22-linux_deleting_critical_directory_using_rm_command.md b/docs/_posts/2022-04-22-linux_deleting_critical_directory_using_rm_command.md index 5ba04fdbcd..c69814f1d1 100644 --- a/docs/_posts/2022-04-22-linux_deleting_critical_directory_using_rm_command.md +++ b/docs/_posts/2022-04-22-linux_deleting_critical_directory_using_rm_command.md @@ -95,7 +95,7 @@ The following analytic identifies a suspicious deletion of a critical folder in -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_deleting_critical_directory_using_rm_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_deleting_critical_directory_using_rm_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ Administrator or network operator can use this application for automation purpos | 64.0 | 80 | 80 | A deletion in known critical list of folder using rm command $process$ executed on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/](https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/) diff --git a/docs/_posts/2022-04-22-linux_disable_services.md b/docs/_posts/2022-04-22-linux_disable_services.md index 74c8ded18b..e922726b56 100644 --- a/docs/_posts/2022-04-22-linux_disable_services.md +++ b/docs/_posts/2022-04-22-linux_disable_services.md @@ -95,7 +95,7 @@ The following analytic is to detect events that attempts to disable a service. T -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_disable_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_disable_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ Administrator or network operator can use this application for automation purpos | 49.0 | 70 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable services on endpoint $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/](https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/) diff --git a/docs/_posts/2022-04-22-linux_high_frequency_of_file_deletion_in_boot_folder.md b/docs/_posts/2022-04-22-linux_high_frequency_of_file_deletion_in_boot_folder.md index aef5edeff2..f0e85c8005 100644 --- a/docs/_posts/2022-04-22-linux_high_frequency_of_file_deletion_in_boot_folder.md +++ b/docs/_posts/2022-04-22-linux_high_frequency_of_file_deletion_in_boot_folder.md @@ -105,7 +105,7 @@ This analytic is to detect a high frequency of file deletion relative to process -#### Search +#### Search ``` @@ -126,7 +126,8 @@ This analytic is to detect a high frequency of file deletion relative to process The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_high_frequency_of_file_deletion_in_boot_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_high_frequency_of_file_deletion_in_boot_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -167,6 +168,9 @@ linux package installer/uninstaller may cause this event. Please update you filt | 80.0 | 100 | 80 | a $process_name$ deleting multiple files in /boot/ folder in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/](https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/) diff --git a/docs/_posts/2022-04-22-linux_shred_overwrite_command.md b/docs/_posts/2022-04-22-linux_shred_overwrite_command.md index ce81e3531b..9ed11867cb 100644 --- a/docs/_posts/2022-04-22-linux_shred_overwrite_command.md +++ b/docs/_posts/2022-04-22-linux_shred_overwrite_command.md @@ -95,7 +95,7 @@ This analytic is to detect a shred process to overwrite a files in a linux machi -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_shred_overwrite_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_shred_overwrite_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ Administrator or network operator can use this application for automation purpos | 49.0 | 70 | 70 | A possible shred overwrite command $process$ executed on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/](https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/) diff --git a/docs/_posts/2022-04-22-linux_stop_services.md b/docs/_posts/2022-04-22-linux_stop_services.md index 9432670b83..65fcfb9135 100644 --- a/docs/_posts/2022-04-22-linux_stop_services.md +++ b/docs/_posts/2022-04-22-linux_stop_services.md @@ -95,7 +95,7 @@ The following analytic is to detect events that attempt to stop or clear a servi -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_stop_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_stop_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ Administrator or network operator can use this application for automation purpos | 49.0 | 70 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified attempting to stop services on endpoint $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/](https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/) diff --git a/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md b/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md index c8714b8410..c2c28a19e8 100644 --- a/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md +++ b/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md @@ -95,7 +95,7 @@ The following analytic is to look for known processes killed by industroyer2 mal -#### Search +#### Search ``` `sysmon` EventCode=5 process_name IN ("PServiceControl.exe", "PService_PPD.exe") @@ -110,7 +110,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **windows_processes_killed_by_industroyer2_malware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_processes_killed_by_industroyer2_malware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ False positives are possible if legitimate applications are allowed to terminate | 36.0 | 60 | 60 | process was terminated $process_name$ in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/](https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/) diff --git a/docs/_posts/2022-04-25-windows_linked_policies_in_adsi_discovery.md b/docs/_posts/2022-04-25-windows_linked_policies_in_adsi_discovery.md index 71060dc5c5..b1a7f26fa3 100644 --- a/docs/_posts/2022-04-25-windows_linked_policies_in_adsi_discovery.md +++ b/docs/_posts/2022-04-25-windows_linked_policies_in_adsi_discovery.md @@ -100,7 +100,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*objectcategory=organizationalunit*" ScriptBlockText = "*findAll()*" @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **windows_linked_policies_in_adsi_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_linked_policies_in_adsi_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ Administrators or power users may use this command for troubleshooting. | 25.0 | 50 | 50 | powershell process having commandline $Message$ for user enumeration | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/](https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/) diff --git a/docs/_posts/2022-04-25-windows_root_domain_linked_policies_discovery.md b/docs/_posts/2022-04-25-windows_root_domain_linked_policies_discovery.md index 8e29df9e15..ddf83513ec 100644 --- a/docs/_posts/2022-04-25-windows_root_domain_linked_policies_discovery.md +++ b/docs/_posts/2022-04-25-windows_root_domain_linked_policies_discovery.md @@ -100,7 +100,7 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) -#### Search +#### Search ``` `powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*.SearchRooT*" ScriptBlockText = "*.gplink*" @@ -115,7 +115,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that **windows_root_domain_linked_policies_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_root_domain_linked_policies_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ Administrators or power users may use this command for troubleshooting. | 25.0 | 50 | 50 | powershell process having commandline $Message$ for user enumeration | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/](https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/) diff --git a/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md b/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md index 2adf3d0732..90333579f1 100644 --- a/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md +++ b/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md @@ -97,7 +97,7 @@ The following query utilizes Windows Security EventCode 4698, A scheduled task w -#### Search +#### Search ``` `wineventlog_security` EventCode=4698 @@ -111,10 +111,11 @@ The following query utilizes Windows Security EventCode 4698, A scheduled task w #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **windows_hidden_schedule_task_settings_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_hidden_schedule_task_settings_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,6 +148,9 @@ unknown | 64.0 | 80 | 80 | A schedule task with hidden setting enable in host $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/](https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/) diff --git a/docs/_posts/2022-04-27-splunk_xss_in_monitoring_console.md b/docs/_posts/2022-04-27-splunk_xss_in_monitoring_console.md index 7e02b3fd6f..1c46fb9433 100644 --- a/docs/_posts/2022-04-27-splunk_xss_in_monitoring_console.md +++ b/docs/_posts/2022-04-27-splunk_xss_in_monitoring_console.md @@ -99,7 +99,7 @@ On May 3rd, 2022, Splunk published a security advisory for a reflective Cross-Si -#### Search +#### Search ``` `splunkd_web` method="GET" uri_query="description=%3C*" @@ -111,7 +111,8 @@ On May 3rd, 2022, Splunk published a security advisory for a reflective Cross-Si The SPL above uses the following Macros: * [splunkd_web](https://github.com/splunk/security_content/blob/develop/macros/splunkd_web.yml) -Note that **splunk_xss_in_monitoring_console_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **splunk_xss_in_monitoring_console_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * method @@ -141,6 +142,9 @@ Use of the monitoring console where the less-than sign (<) is the first characte | 40.0 | 50 | 80 | A potential XSS attempt has been detected from $user$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.splunk.com/en_us/product-security/announcements/svd-2022-0505.html](https://www.splunk.com/en_us/product-security/announcements/svd-2022-0505.html) diff --git a/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md b/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md index 146d180d99..f01045f1e6 100644 --- a/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md +++ b/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md @@ -95,7 +95,7 @@ The following analytic identifes a Computer Account creating a new Computer Acco -#### Search +#### Search ``` `wineventlog_security` EventCode=4741 user_type=computer Subject_Account_Domain!="NT AUTHORITY" Message=*RestrictedKrbHost* @@ -107,10 +107,11 @@ The following analytic identifes a Computer Account creating a new Computer Acco #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **windows_computer_account_created_by_computer_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_computer_account_created_by_computer_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ It is possible third party applications may have a computer account that adds co | 30.0 | 50 | 60 | A Computer Account created a Computer Account on $dest$, possibly indicative of Kerberos relay attack. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/445e4499-7e49-4f2a-8d82-aaf2d1ee3c47](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/445e4499-7e49-4f2a-8d82-aaf2d1ee3c47) diff --git a/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md b/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md index e5d628dce7..2254065a55 100644 --- a/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md +++ b/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md @@ -95,7 +95,7 @@ The following analytic identifies a ComputerAccount requesting a Kerberos Ticket -#### Search +#### Search ``` `wineventlog_security` EventCode=4768 Account_Name="*$" src_ip!="::1" @@ -107,10 +107,11 @@ The following analytic identifies a ComputerAccount requesting a Kerberos Ticket #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **windows_computer_account_requesting_kerberos_ticket_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_computer_account_requesting_kerberos_ticket_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ It is possible false positives will be present based on third party applications | 35.0 | 50 | 70 | A Computer Account requested a Kerberos ticket on $dest$, possibly indicative of Kerberos relay attack. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/Dec0ne/KrbRelayUp](https://github.com/Dec0ne/KrbRelayUp) diff --git a/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md b/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md index 7a3052bd77..e7d7263528 100644 --- a/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md +++ b/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md @@ -95,7 +95,7 @@ The following analytic identifies a local successful authentication event on a W -#### Search +#### Search ``` `wineventlog_security` EventCode=4624 Logon_Type=3 Authentication_Package=Kerberos action=success src_ip=127.0.0.1 @@ -107,10 +107,11 @@ The following analytic identifies a local successful authentication event on a W #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **windows_kerberos_local_successful_logon_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_kerberos_local_successful_logon_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,6 +144,9 @@ False positives are possible, filtering may be required to restrict to workstati | 64.0 | 80 | 80 | A successful localhost Kerberos authentication event occurred on $dest$, possibly indicative of Kerberos relay attack. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/Dec0ne/KrbRelayUp](https://github.com/Dec0ne/KrbRelayUp) diff --git a/docs/_posts/2022-04-28-windows_computer_account_with_spn.md b/docs/_posts/2022-04-28-windows_computer_account_with_spn.md index b1db46cdf5..432c1e8aa7 100644 --- a/docs/_posts/2022-04-28-windows_computer_account_with_spn.md +++ b/docs/_posts/2022-04-28-windows_computer_account_with_spn.md @@ -95,7 +95,7 @@ The following analytic identifies two SPNs, HOST and RestrictedKrbHost, added us -#### Search +#### Search ``` `wineventlog_security` EventCode=4741 MSADChangedAttributes IN ("*HOST/*","*RestrictedKrbHost/*") AND New_UAC_Value=0x80 @@ -109,10 +109,11 @@ The following analytic identifies two SPNs, HOST and RestrictedKrbHost, added us #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that **windows_computer_account_with_spn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_computer_account_with_spn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,6 +147,9 @@ It is possible third party applications may add these SPNs to Computer Accounts, | 64.0 | 80 | 80 | A Computer Account was created with SPNs related to Kerberos on $dest$, possibly indicative of Kerberos relay attack. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.trustedsec.com/blog/an-attack-path-mapping-approach-to-cves-2021-42287-and-2021-42278](https://www.trustedsec.com/blog/an-attack-path-mapping-approach-to-cves-2021-42287-and-2021-42278) diff --git a/docs/_posts/2022-04-29-path_traversal_spl_injection.md b/docs/_posts/2022-04-29-path_traversal_spl_injection.md index fe10d565b7..cf4726827d 100644 --- a/docs/_posts/2022-04-29-path_traversal_spl_injection.md +++ b/docs/_posts/2022-04-29-path_traversal_spl_injection.md @@ -90,14 +90,14 @@ On May 3rd, 2022, Splunk published a security advisory for a Path traversal in s
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2022-26889](https://nvd.nist.gov/vuln/detail/CVE-2022-26889) | The lack of sanitization in a relative url path in a search parameter allows for arbitrary injection of external content in Splunk Enterprise versions before 8.1.2. | 7.5 | +| [CVE-2022-26889](https://nvd.nist.gov/vuln/detail/CVE-2022-26889) | The lack of sanitization in a relative url path in a search parameter allows for arbitrary injection of external content in Splunk Enterprise versions before 8.1.2. | 5.1 |
-#### Search +#### Search ``` `path_traversal_spl_injection` @@ -110,7 +110,8 @@ On May 3rd, 2022, Splunk published a security advisory for a Path traversal in s The SPL above uses the following Macros: * [path_traversal_spl_injection](https://github.com/splunk/security_content/blob/develop/macros/path_traversal_spl_injection.yml) -Note that **path_traversal_spl_injection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **path_traversal_spl_injection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * status @@ -139,6 +140,9 @@ This search may find additional path traversal exploitation attempts. | 40.0 | 50 | 80 | Path traversal exploitation attempt from $clientip$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.splunk.com/en_us/product-security/announcements/svd-2022-0506.html](https://www.splunk.com/en_us/product-security/announcements/svd-2022-0506.html) diff --git a/docs/_posts/2022-04-29-splunk_user_enumeration_attempt.md b/docs/_posts/2022-04-29-splunk_user_enumeration_attempt.md index 91b1cc0166..e6b19c860e 100644 --- a/docs/_posts/2022-04-29-splunk_user_enumeration_attempt.md +++ b/docs/_posts/2022-04-29-splunk_user_enumeration_attempt.md @@ -102,7 +102,7 @@ On May 3rd, 2022, Splunk published a security advisory for username enumeration -#### Search +#### Search ``` `splunkd_failed_auths` @@ -116,7 +116,8 @@ On May 3rd, 2022, Splunk published a security advisory for username enumeration The SPL above uses the following Macros: * [splunkd_failed_auths](https://github.com/splunk/security_content/blob/develop/macros/splunkd_failed_auths.yml) -Note that **splunk_user_enumeration_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **splunk_user_enumeration_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * user @@ -144,6 +145,9 @@ Automation executing authentication attempts against your Splunk infrastructure | 40.0 | 50 | 80 | $TotalFailedAuths$ failed authentication events to Splunk from $src$ detected. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.splunk.com/en_us/product-security/announcements/svd-2022-0502.html](https://www.splunk.com/en_us/product-security/announcements/svd-2022-0502.html) diff --git a/docs/_posts/2022-04-30-linux_iptables_firewall_modification.md b/docs/_posts/2022-04-30-linux_iptables_firewall_modification.md index ada8ae20de..6bc47412ff 100644 --- a/docs/_posts/2022-04-30-linux_iptables_firewall_modification.md +++ b/docs/_posts/2022-04-30-linux_iptables_firewall_modification.md @@ -100,7 +100,7 @@ This analytic looks for suspicious commandline that modify the iptables firewall -#### Search +#### Search ``` @@ -124,7 +124,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_iptables_firewall_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_iptables_firewall_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -156,6 +157,9 @@ administrator may do this commandline for auditing and testing purposes. In this | 25.0 | 50 | 50 | A commandline $process$ that may modify iptables firewall on $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf](https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf) diff --git a/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md b/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md index 1e9fc298f0..5e9fe33916 100644 --- a/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md +++ b/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md @@ -100,7 +100,7 @@ This analytic looks for suspicious process kworker commandline in a linux machin -#### Search +#### Search ``` @@ -116,7 +116,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **linux_kworker_process_in_writable_process_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **linux_kworker_process_in_writable_process_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,6 +151,9 @@ unknown | 36.0 | 60 | 60 | a $process_name$ with kworker commandline in $dest$ | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf](https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf) diff --git a/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md b/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md index 5d84c488f2..030bf05c8b 100644 --- a/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md +++ b/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md @@ -96,7 +96,7 @@ The following analytic identifies the default service name created by KrbRelayUp -#### Search +#### Search ``` `wineventlog_system` EventCode=7045 Service_Name IN ("KrbSCM") @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) -Note that **windows_krbrelayup_service_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_krbrelayup_service_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ False positives should be limited as this is specific to KrbRelayUp based attack | 64.0 | 80 | 80 | A service was created on $dest$, related to KrbRelayUp. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/Dec0ne/KrbRelayUp](https://github.com/Dec0ne/KrbRelayUp) diff --git a/docs/_posts/2022-05-05-windows_service_create_kernel_mode_driver.md b/docs/_posts/2022-05-05-windows_service_create_kernel_mode_driver.md index 47165ffea1..8c0169beb3 100644 --- a/docs/_posts/2022-05-05-windows_service_create_kernel_mode_driver.md +++ b/docs/_posts/2022-05-05-windows_service_create_kernel_mode_driver.md @@ -107,7 +107,7 @@ The following analytic identifes a new kernel driver being added to Windows usin -#### Search +#### Search ``` @@ -123,7 +123,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_service_create_kernel_mode_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_service_create_kernel_mode_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -157,6 +158,9 @@ False positives may be present based on common applications adding new drivers, | 48.0 | 60 | 80 | Service control, $process_name$, loaded a new kernel mode driver on $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/](https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/) diff --git a/docs/_posts/2022-05-10-detect_aws_console_login_by_new_user.md b/docs/_posts/2022-05-10-detect_aws_console_login_by_new_user.md index e79bf89f38..33ccf452bc 100644 --- a/docs/_posts/2022-05-10-detect_aws_console_login_by_new_user.md +++ b/docs/_posts/2022-05-10-detect_aws_console_login_by_new_user.md @@ -86,7 +86,7 @@ This search looks for AWS CloudTrail events wherein a console login event by a u -#### Search +#### Search ``` @@ -105,7 +105,8 @@ This search looks for AWS CloudTrail events wherein a console login event by a u The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **detect_aws_console_login_by_new_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_aws_console_login_by_new_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -137,6 +138,9 @@ When a legitimate new user logins for the first time, this activity will be dete | 30.0 | 50 | 60 | User $user$ is logging into the AWS console for the first time | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2022-05-10-f5_big-ip_icontrol_rest_vulnerability_cve-2022-1388.md b/docs/_posts/2022-05-10-f5_big-ip_icontrol_rest_vulnerability_cve-2022-1388.md index 95add92e97..61c8a18b13 100644 --- a/docs/_posts/2022-05-10-f5_big-ip_icontrol_rest_vulnerability_cve-2022-1388.md +++ b/docs/_posts/2022-05-10-f5_big-ip_icontrol_rest_vulnerability_cve-2022-1388.md @@ -100,7 +100,7 @@ The following analytic identifies a recent unauthenticated remote code execution -#### Search +#### Search ``` @@ -115,7 +115,8 @@ The following analytic identifies a recent unauthenticated remote code execution The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **f5_big-ip_icontrol_rest_vulnerability_cve-2022-1388_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **f5_big-ip_icontrol_rest_vulnerability_cve-2022-1388_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Web.http_method @@ -145,6 +146,9 @@ False positives may be present if the activity is blocked or was not successful. | 70.0 | 100 | 70 | An attempt to exploit CVE-2022-1388 against an F5 appliance $dest$ has occurred. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/dk4trin/templates-nuclei/blob/main/CVE-2022-1388.yaml](https://github.com/dk4trin/templates-nuclei/blob/main/CVE-2022-1388.yaml) diff --git a/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md b/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md index 1d4c7f5355..eb233f9012 100644 --- a/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md +++ b/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md @@ -95,7 +95,7 @@ Upon triage, review the process performing the named pipe. If it is explorer.exe -#### Search +#### Search ``` `sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\DserNamePipe*, \\srvsvc_*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*, \\ntsvcs*, \\winsock*, \\UIA_PIPE*) @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that **cobalt_strike_named_pipes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **cobalt_strike_named_pipes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,6 +145,9 @@ The idea of using named pipes with Cobalt Strike is to blend in. Therefore, some | 72.0 | 80 | 90 | An instance of $process_name$ was identified on endpoint $Computer$ by user $user$ accessing known suspicious named pipes related to Cobalt Strike. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://attack.mitre.org/techniques/T1218/009/](https://attack.mitre.org/techniques/T1218/009/) diff --git a/docs/_posts/2022-05-16-windows_system_file_on_disk.md b/docs/_posts/2022-05-16-windows_system_file_on_disk.md index 36d7d8b6cf..3e06cdcbdd 100644 --- a/docs/_posts/2022-05-16-windows_system_file_on_disk.md +++ b/docs/_posts/2022-05-16-windows_system_file_on_disk.md @@ -95,7 +95,7 @@ The following hunting analytic will assist with identifying new .sys files intro -#### Search +#### Search ``` @@ -111,7 +111,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **windows_system_file_on_disk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **windows_system_file_on_disk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,6 +146,9 @@ False positives will be present. Filter as needed. | 10.0 | 20 | 50 | A new driver is present on $dest$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/](https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/) diff --git a/docs/_posts/2022-05-17-aws_create_policy_version_to_allow_all_resources.md b/docs/_posts/2022-05-17-aws_create_policy_version_to_allow_all_resources.md index 6c5243e5c3..95f1019282 100644 --- a/docs/_posts/2022-05-17-aws_create_policy_version_to_allow_all_resources.md +++ b/docs/_posts/2022-05-17-aws_create_policy_version_to_allow_all_resources.md @@ -105,7 +105,7 @@ This search looks for AWS CloudTrail events where a user created a policy versio -#### Search +#### Search ``` `cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.com errorCode = success @@ -124,7 +124,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **aws_create_policy_version_to_allow_all_resources_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **aws_create_policy_version_to_allow_all_resources_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -158,6 +159,9 @@ While this search has no known false positives, it is possible that an AWS admin | 49.0 | 70 | 70 | User $user$ created a policy version that allows them to access any resource in their account. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws](https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws) diff --git a/docs/_posts/2022-05-19-vmware_server_side_template_injection_hunt.md b/docs/_posts/2022-05-19-vmware_server_side_template_injection_hunt.md index 063c1f92ca..d31345e5e3 100644 --- a/docs/_posts/2022-05-19-vmware_server_side_template_injection_hunt.md +++ b/docs/_posts/2022-05-19-vmware_server_side_template_injection_hunt.md @@ -100,7 +100,7 @@ The following hunting analytic identifies the server side template injection rel -#### Search +#### Search ``` @@ -115,7 +115,8 @@ The following hunting analytic identifies the server side template injection rel The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **vmware_server_side_template_injection_hunt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **vmware_server_side_template_injection_hunt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Web.http_method @@ -145,6 +146,9 @@ False positives may be present if the activity is blocked or was not successful. | 35.0 | 70 | 50 | An attempt to exploit a VMware Server Side Injection CVE-2022-22954 on $dest$ has occurred. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.cisa.gov/uscert/sites/default/files/publications/CISA_CSA_Threat_Actors_Chaining_VMware_Unpatched_Vulnerabilities_for_Full_System_Control.pdf](https://www.cisa.gov/uscert/sites/default/files/publications/CISA_CSA_Threat_Actors_Chaining_VMware_Unpatched_Vulnerabilities_for_Full_System_Control.pdf) diff --git a/docs/_posts/2022-05-19-vmware_workspace_one_freemarker_server-side_template_injection.md b/docs/_posts/2022-05-19-vmware_workspace_one_freemarker_server-side_template_injection.md index a23655785f..c6bcef3597 100644 --- a/docs/_posts/2022-05-19-vmware_workspace_one_freemarker_server-side_template_injection.md +++ b/docs/_posts/2022-05-19-vmware_workspace_one_freemarker_server-side_template_injection.md @@ -100,7 +100,7 @@ The following analytic identifies the server side template injection related to -#### Search +#### Search ``` @@ -115,7 +115,8 @@ The following analytic identifies the server side template injection related to The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that **vmware_workspace_one_freemarker_server-side_template_injection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **vmware_workspace_one_freemarker_server-side_template_injection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Web.http_method @@ -145,6 +146,9 @@ False positives may be present if the activity is blocked or was not successful. | 49.0 | 70 | 70 | An attempt to exploit a VMware Server Side Injection CVE-2022-22954 on $dest$ has occurred. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://www.cisa.gov/uscert/sites/default/files/publications/CISA_CSA_Threat_Actors_Chaining_VMware_Unpatched_Vulnerabilities_for_Full_System_Control.pdf](https://www.cisa.gov/uscert/sites/default/files/publications/CISA_CSA_Threat_Actors_Chaining_VMware_Unpatched_Vulnerabilities_for_Full_System_Control.pdf) diff --git a/docs/_posts/2022-05-23-schtasks_scheduling_job_on_remote_system.md b/docs/_posts/2022-05-23-schtasks_scheduling_job_on_remote_system.md index dfea94af8a..f6dd72bb0b 100644 --- a/docs/_posts/2022-05-23-schtasks_scheduling_job_on_remote_system.md +++ b/docs/_posts/2022-05-23-schtasks_scheduling_job_on_remote_system.md @@ -102,7 +102,7 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume -#### Search +#### Search ``` @@ -118,7 +118,8 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that **schtasks_scheduling_job_on_remote_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **schtasks_scheduling_job_on_remote_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,6 +151,9 @@ Administrators may create scheduled tasks on remote systems, but this activity i | 63.0 | 70 | 90 | A schedule task process $process_name$ with remote job command-line $process$ in host $dest$ by $user$. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/docs/_posts/2022-05-26-linux_at_application_execution.md b/docs/_posts/2022-05-26-linux_at_application_execution.md new file mode 100644 index 0000000000..b5f03fb2f5 --- /dev/null +++ b/docs/_posts/2022-05-26-linux_at_application_execution.md @@ -0,0 +1,176 @@ +--- +title: "Linux At Application Execution" +excerpt: "At +, Scheduled Task/Job +" +categories: + - Endpoint +last_modified_at: 2022-05-26 +toc: true +toc_label: "" +tags: + - At + - Scheduled Task/Job + - Execution + - Persistence + - Privilege Escalation + - Execution + - Persistence + - Privilege Escalation + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies a suspicious process creation of At application. This process can be used by malware, adversaries and red teamers to create persistence entry to the targeted or compromised host with their malicious code. This anomaly detection can be a good indicator to investigate the event before and after this process execution, when it was executed and what schedule task it will execute. + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-05-26 +- **Author**: Teoderick Contreras, Splunk +- **ID**: bf0a378e-5f3c-11ec-a6de-acde48001122 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1053.002](https://attack.mitre.org/techniques/T1053/002/) | At | Execution, Persistence, Privilege Escalation | + +| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` + +| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes where Processes.process_name IN ("at", "atd") OR Processes.parent_process_name IN ("at", "atd") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `linux_at_application_execution_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +> :information_source: +> **linux_at_application_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_id + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. + +#### Known False Positives +Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. + +#### Associated Analytic story +* [Linux Privilege Escalation](/stories/linux_privilege_escalation) +* [Linux Persistence Techniques](/stories/linux_persistence_techniques) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 9.0 | 30 | 30 | At application was executed in $dest$ | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://attack.mitre.org/techniques/T1053/001/](https://attack.mitre.org/techniques/T1053/001/) +* [https://www.linkedin.com/pulse/getting-attacker-ip-address-from-malicious-linux-job-craig-rowland/](https://www.linkedin.com/pulse/getting-attacker-ip-address-from-malicious-linux-job-craig-rowland/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/at_execution/sysmon_linux.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/at_execution/sysmon_linux.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/linux_at_application_execution.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2022-05-26-linux_possible_append_command_to_at_allow_config_file.md b/docs/_posts/2022-05-26-linux_possible_append_command_to_at_allow_config_file.md new file mode 100644 index 0000000000..186585638e --- /dev/null +++ b/docs/_posts/2022-05-26-linux_possible_append_command_to_at_allow_config_file.md @@ -0,0 +1,176 @@ +--- +title: "Linux Possible Append Command To At Allow Config File" +excerpt: "At +, Scheduled Task/Job +" +categories: + - Endpoint +last_modified_at: 2022-05-26 +toc: true +toc_label: "" +tags: + - At + - Scheduled Task/Job + - Execution + - Persistence + - Privilege Escalation + - Execution + - Persistence + - Privilege Escalation + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic looks for suspicious commandline that may use to append user entry to /etc/at.allow or /etc/at.deny. These 2 files are commonly abused by malware, adversaries or red teamers to persist on the targeted or compromised host. These config file can restrict user that can only execute at application (another schedule task application in linux). attacker can create a user or add the compromised username to that config file to execute at to schedule it malicious code. This anomaly detection can be a good indicator to investigate further the entry in created config file and who created it to verify if it is a false positive. + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-05-26 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 7bc20606-5f40-11ec-a586-acde48001122 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1053.002](https://attack.mitre.org/techniques/T1053/002/) | At | Execution, Persistence, Privilege Escalation | + +| [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` + +| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes where Processes.process = "*echo*" AND Processes.process IN("*/etc/at.allow", "*/etc/at.deny") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `linux_possible_append_command_to_at_allow_config_file_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +> :information_source: +> **linux_possible_append_command_to_at_allow_config_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_id + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. + +#### Known False Positives +Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives. + +#### Associated Analytic story +* [Linux Privilege Escalation](/stories/linux_privilege_escalation) +* [Linux Persistence Techniques](/stories/linux_persistence_techniques) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 9.0 | 30 | 30 | A commandline $process$ that may modify at allow config file in $dest$ | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://linuxize.com/post/at-command-in-linux/](https://linuxize.com/post/at-command-in-linux/) +* [https://attack.mitre.org/techniques/T1053/001/](https://attack.mitre.org/techniques/T1053/001/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/at_execution/sysmon_linux.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/at_execution/sysmon_linux.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2022-05-26-macos_plutil.md b/docs/_posts/2022-05-26-macos_plutil.md new file mode 100644 index 0000000000..7d207f05b0 --- /dev/null +++ b/docs/_posts/2022-05-26-macos_plutil.md @@ -0,0 +1,166 @@ +--- +title: "MacOS plutil" +excerpt: "Plist File Modification +" +categories: + - Endpoint +last_modified_at: 2022-05-26 +toc: true +toc_label: "" +tags: + - Plist File Modification + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +Detect usage of plutil to modify plist files. Adversaries can modiy plist files to executed binaries or add command line arguments. Plist files in auto-run locations are executed upon user logon or system startup. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-05-26 +- **Author**: Patrick Bareiss, Splunk +- **ID**: c11f2b57-92c1-4cd2-b46c-064eafb833ac + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1647](https://attack.mitre.org/techniques/T1647/) | Plist File Modification | Defense Evasion | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Actions on Objectives + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` +`osquery` name=es_process_events columns.path=/usr/bin/plutil +| rename columns.* as * +| stats count min(_time) as firstTime max(_time) as lastTime by username host cmdline pid path parent signing_id +| rename username as User, cmdline as process, path as process_path +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `macos_plutil_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [osquery](https://github.com/splunk/security_content/blob/develop/macros/osquery.yml) + +> :information_source: +> **macos_plutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* columns.cmdline +* columns.pid +* columns.parent +* columns.path +* columns.signing_id +* columns.username +* host + + +#### How To Implement +This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + +#### Known False Positives +Administrators using plutil to change plist files. + +#### Associated Analytic story +* [Living Off The Land](/stories/living_off_the_land) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 25.0 | 50 | 50 | plutil are executed on $host$ from $user$ | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://osquery.readthedocs.io/en/stable/deployment/process-auditing/](https://osquery.readthedocs.io/en/stable/deployment/process-auditing/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1647/atomic_red_team/osquery.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1647/atomic_red_team/osquery.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/macos_plutil.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_stories/active_directory_lateral_movement.md b/docs/_stories/active_directory_lateral_movement.md index 00a97941dd..12fee30468 100644 --- a/docs/_stories/active_directory_lateral_movement.md +++ b/docs/_stories/active_directory_lateral_movement.md @@ -54,7 +54,7 @@ If there is evidence of lateral movement, it is imperative for analysts to colle | [Remote Process Instantiation via WMI](/endpoint/remote_process_instantiation_via_wmi/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation)| TTP | | [Remote Process Instantiation via WMI and PowerShell](/endpoint/remote_process_instantiation_via_wmi_and_powershell/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation)| TTP | | [Remote Process Instantiation via WMI and PowerShell Script Block](/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation)| TTP | -| [Scheduled Task Creation on Remote Endpoint using At](/endpoint/scheduled_task_creation_on_remote_endpoint_using_at/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [At (Windows)](/tags/#at-(windows))| TTP | +| [Scheduled Task Creation on Remote Endpoint using At](/endpoint/scheduled_task_creation_on_remote_endpoint_using_at/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [At](/tags/#at)| TTP | | [Scheduled Task Initiation on Remote Endpoint](/endpoint/scheduled_task_initiation_on_remote_endpoint/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Scheduled Task](/tags/#scheduled-task)| TTP | | [Schtasks scheduling job on remote system](/endpoint/schtasks_scheduling_job_on_remote_system/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP | | [Services LOLBAS Execution Process Spawn](/endpoint/services_lolbas_execution_process_spawn/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service)| TTP | diff --git a/docs/_stories/cobalt_strike.md b/docs/_stories/cobalt_strike.md index b023ae9ba4..5a4b0e2248 100644 --- a/docs/_stories/cobalt_strike.md +++ b/docs/_stories/cobalt_strike.md @@ -44,10 +44,10 @@ While investigating a detection related to this Analytic Story, keep in mind the | [Anomalous usage of 7zip](/endpoint/anomalous_usage_of_7zip/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data)| Anomaly | | [CMD Echo Pipe - Escalation](/endpoint/cmd_echo_pipe_-_escalation/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process)| TTP | | [Cobalt Strike Named Pipes](/endpoint/cobalt_strike_named_pipes/) | [Process Injection](/tags/#process-injection)| TTP | -| [Detect Regsvr32 Application Control Bypass](/endpoint/detect_regsvr32_application_control_bypass/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| TTP | +| [Detect Regsvr32 Application Control Bypass](/endpoint/detect_regsvr32_application_control_bypass/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| TTP | | [DLLHost with no Command Line Arguments with Network](/endpoint/dllhost_with_no_command_line_arguments_with_network/) | [Process Injection](/tags/#process-injection)| TTP | | [GPUpdate with no Command Line Arguments with Network](/endpoint/gpupdate_with_no_command_line_arguments_with_network/) | [Process Injection](/tags/#process-injection)| TTP | -| [Rundll32 with no Command Line Arguments with Network](/endpoint/rundll32_with_no_command_line_arguments_with_network/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Rundll32 with no Command Line Arguments with Network](/endpoint/rundll32_with_no_command_line_arguments_with_network/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | | [SearchProtocolHost with no Command Line with Network](/endpoint/searchprotocolhost_with_no_command_line_with_network/) | [Process Injection](/tags/#process-injection)| TTP | | [Services Escalate Exe](/endpoint/services_escalate_exe/) | [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP | | [Suspicious DLLHost no Command Line Arguments](/endpoint/suspicious_dllhost_no_command_line_arguments/) | [Process Injection](/tags/#process-injection)| TTP | @@ -55,8 +55,8 @@ While investigating a detection related to this Analytic Story, keep in mind the | [Suspicious microsoft workflow compiler rename](/endpoint/suspicious_microsoft_workflow_compiler_rename/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities)| Hunting | | [Suspicious msbuild path](/endpoint/suspicious_msbuild_path/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild)| TTP | | [Suspicious MSBuild Rename](/endpoint/suspicious_msbuild_rename/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild)| Hunting | -| [Suspicious Rundll32 StartW](/endpoint/suspicious_rundll32_startw/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | -| [Suspicious Rundll32 no Command Line Arguments](/endpoint/suspicious_rundll32_no_command_line_arguments/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Suspicious Rundll32 StartW](/endpoint/suspicious_rundll32_startw/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Suspicious Rundll32 no Command Line Arguments](/endpoint/suspicious_rundll32_no_command_line_arguments/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | | [Suspicious SearchProtocolHost no Command Line Arguments](/endpoint/suspicious_searchprotocolhost_no_command_line_arguments/) | [Process Injection](/tags/#process-injection)| TTP | #### Reference diff --git a/docs/_stories/command_and_control.md b/docs/_stories/command_and_control.md index 4774021ae1..bc37a93a9b 100644 --- a/docs/_stories/command_and_control.md +++ b/docs/_stories/command_and_control.md @@ -37,9 +37,9 @@ Because this communication is so critical for an adversary, they often use techn | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Clients Connecting to Multiple DNS Servers](/deprecated/clients_connecting_to_multiple_dns_servers/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol)| TTP | -| [Detect Long DNS TXT Record Response](/deprecated/detect_long_dns_txt_record_response/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol)| TTP | -| [Detection of DNS Tunnels](/deprecated/detection_of_dns_tunnels/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol)| TTP | +| [Clients Connecting to Multiple DNS Servers](/deprecated/clients_connecting_to_multiple_dns_servers/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol)| TTP | +| [Detect Long DNS TXT Record Response](/deprecated/detect_long_dns_txt_record_response/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol)| TTP | +| [Detection of DNS Tunnels](/deprecated/detection_of_dns_tunnels/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol)| TTP | | [DNS Query Requests Resolved by Unauthorized DNS Servers](/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers/) | [DNS](/tags/#dns)| TTP | | [DNS Exfiltration Using Nslookup App](/endpoint/dns_exfiltration_using_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| TTP | | [Excessive Usage of NSLOOKUP App](/endpoint/excessive_usage_of_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| Anomaly | @@ -48,12 +48,12 @@ Because this communication is so critical for an adversary, they often use techn | [DNS Query Length Outliers - MLTK](/network/dns_query_length_outliers_-_mltk/) | [DNS](/tags/#dns), [Application Layer Protocol](/tags/#application-layer-protocol)| Anomaly | | [Excessive DNS Failures](/network/excessive_dns_failures/) | [DNS](/tags/#dns), [Application Layer Protocol](/tags/#application-layer-protocol)| Anomaly | | [Prohibited Network Traffic Allowed](/network/prohibited_network_traffic_allowed/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| TTP | -| [Protocol or Port Mismatch](/network/protocol_or_port_mismatch/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| Anomaly | +| [Protocol or Port Mismatch](/network/protocol_or_port_mismatch/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| Anomaly | | [TOR Traffic](/network/tor_traffic/) | [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols)| TTP | | [Detect hosts connecting to dynamic domain providers](/network/detect_hosts_connecting_to_dynamic_domain_providers/) | [Drive-by Compromise](/tags/#drive-by-compromise)| TTP | -| [DNS Query Length With High Standard Deviation](/network/dns_query_length_with_high_standard_deviation/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| Anomaly | -| [Multiple Archive Files Http Post Traffic](/network/multiple_archive_files_http_post_traffic/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| TTP | -| [Plain HTTP POST Exfiltrated Data](/network/plain_http_post_exfiltrated_data/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| TTP | +| [DNS Query Length With High Standard Deviation](/network/dns_query_length_with_high_standard_deviation/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| Anomaly | +| [Multiple Archive Files Http Post Traffic](/network/multiple_archive_files_http_post_traffic/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| TTP | +| [Plain HTTP POST Exfiltrated Data](/network/plain_http_post_exfiltrated_data/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| TTP | #### Reference diff --git a/docs/_stories/darkside_ransomware.md b/docs/_stories/darkside_ransomware.md index add9b10ea8..ce028ffd25 100644 --- a/docs/_stories/darkside_ransomware.md +++ b/docs/_stories/darkside_ransomware.md @@ -36,7 +36,7 @@ This story addresses Darkside ransomware. This ransomware payload has many simil | [BITSAdmin Download File](/endpoint/bitsadmin_download_file/) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer)| TTP | | [CertUtil Download With URLCache and Split Arguments](/endpoint/certutil_download_with_urlcache_and_split_arguments/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer)| TTP | | [CertUtil Download With VerifyCtl and Split Arguments](/endpoint/certutil_download_with_verifyctl_and_split_arguments/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer)| TTP | -| [CMLUA Or CMSTPLUA UAC Bypass](/endpoint/cmlua_or_cmstplua_uac_bypass/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp)| TTP | +| [CMLUA Or CMSTPLUA UAC Bypass](/endpoint/cmlua_or_cmstplua_uac_bypass/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [CMSTP](/tags/#cmstp)| TTP | | [Cobalt Strike Named Pipes](/endpoint/cobalt_strike_named_pipes/) | [Process Injection](/tags/#process-injection)| TTP | | [Delete ShadowCopy With PowerShell](/endpoint/delete_shadowcopy_with_powershell/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery)| TTP | | [Detect Mimikatz Using Loaded Images](/endpoint/detect_mimikatz_using_loaded_images/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping)| TTP | diff --git a/docs/_stories/data_destruction.md b/docs/_stories/data_destruction.md index 5cc33e9075..28148fd502 100644 --- a/docs/_stories/data_destruction.md +++ b/docs/_stories/data_destruction.md @@ -37,7 +37,7 @@ Adversaries may use this technique to maximize the impact on the target organiza | [Linux DD File Overwrite](/endpoint/linux_dd_file_overwrite/) | [Data Destruction](/tags/#data-destruction)| TTP | | [Linux Deleting Critical Directory Using RM Command](/endpoint/linux_deleting_critical_directory_using_rm_command/) | [Data Destruction](/tags/#data-destruction)| TTP | | [Linux High Frequency Of File Deletion In Boot Folder](/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder/) | [Data Destruction](/tags/#data-destruction), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host)| TTP | -| [Regsvr32 Silent and Install Param Dll Loading](/endpoint/regsvr32_silent_and_install_param_dll_loading/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| Anomaly | +| [Regsvr32 Silent and Install Param Dll Loading](/endpoint/regsvr32_silent_and_install_param_dll_loading/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| Anomaly | | [Suspicious Process File Path](/endpoint/suspicious_process_file_path/) | [Create or Modify System Process](/tags/#create-or-modify-system-process)| TTP | | [Windows Disable Memory Crash Dump](/endpoint/windows_disable_memory_crash_dump/) | [Data Destruction](/tags/#data-destruction)| TTP | | [Windows File Without Extension In Critical Folder](/endpoint/windows_file_without_extension_in_critical_folder/) | [Data Destruction](/tags/#data-destruction)| TTP | diff --git a/docs/_stories/data_exfiltration.md b/docs/_stories/data_exfiltration.md index 57d7307ca6..b705879b14 100644 --- a/docs/_stories/data_exfiltration.md +++ b/docs/_stories/data_exfiltration.md @@ -42,8 +42,8 @@ Exfiltration comes in many flavors. Adversaries can collect data over encrypted | [Mailsniper Invoke functions](/endpoint/mailsniper_invoke_functions/) | [Email Collection](/tags/#email-collection), [Local Email Collection](/tags/#local-email-collection)| TTP | | [Gdrive suspicious file sharing](/cloud/gdrive_suspicious_file_sharing/) | [Phishing](/tags/#phishing)| Hunting | | [Detect SNICat SNI Exfiltration](/network/detect_snicat_sni_exfiltration/) | [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel)| TTP | -| [Multiple Archive Files Http Post Traffic](/network/multiple_archive_files_http_post_traffic/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| TTP | -| [Plain HTTP POST Exfiltrated Data](/network/plain_http_post_exfiltrated_data/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| TTP | +| [Multiple Archive Files Http Post Traffic](/network/multiple_archive_files_http_post_traffic/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| TTP | +| [Plain HTTP POST Exfiltrated Data](/network/plain_http_post_exfiltrated_data/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| TTP | #### Reference diff --git a/docs/_stories/data_protection.md b/docs/_stories/data_protection.md index 5c100eeede..667578a818 100644 --- a/docs/_stories/data_protection.md +++ b/docs/_stories/data_protection.md @@ -35,7 +35,7 @@ Attackers can leverage a variety of resources to compromise or exfiltrate enterp | Name | Technique | Type | | ----------- | ----------- |--------------| | [Detect USB device insertion](/deprecated/detect_usb_device_insertion/) | None| TTP | -| [Detection of DNS Tunnels](/deprecated/detection_of_dns_tunnels/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol)| TTP | +| [Detection of DNS Tunnels](/deprecated/detection_of_dns_tunnels/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol)| TTP | | [Detect hosts connecting to dynamic domain providers](/network/detect_hosts_connecting_to_dynamic_domain_providers/) | [Drive-by Compromise](/tags/#drive-by-compromise)| TTP | #### Reference diff --git a/docs/_stories/dev_sec_ops.md b/docs/_stories/dev_sec_ops.md index 4d6b59a19b..4703354b9e 100644 --- a/docs/_stories/dev_sec_ops.md +++ b/docs/_stories/dev_sec_ops.md @@ -49,7 +49,7 @@ DevSecOps is a collaborative framework, which thinks about application and infra | [GSuite Email Suspicious Attachment](/cloud/gsuite_email_suspicious_attachment/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing)| Anomaly | | [Gsuite Email Suspicious Subject With Attachment](/cloud/gsuite_email_suspicious_subject_with_attachment/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing)| Anomaly | | [Gsuite Email With Known Abuse Web Service Link](/cloud/gsuite_email_with_known_abuse_web_service_link/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing)| Anomaly | -| [Gsuite Outbound Email With Attachment To External Domain](/cloud/gsuite_outbound_email_with_attachment_to_external_domain/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| Anomaly | +| [Gsuite Outbound Email With Attachment To External Domain](/cloud/gsuite_outbound_email_with_attachment_to_external_domain/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| Anomaly | | [Gsuite Suspicious Shared File Name](/cloud/gsuite_suspicious_shared_file_name/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing)| Anomaly | | [Kubernetes Nginx Ingress LFI](/cloud/kubernetes_nginx_ingress_lfi/) | [Exploitation for Credential Access](/tags/#exploitation-for-credential-access)| TTP | | [Kubernetes Nginx Ingress RFI](/cloud/kubernetes_nginx_ingress_rfi/) | [Exploitation for Credential Access](/tags/#exploitation-for-credential-access)| TTP | diff --git a/docs/_stories/dns_hijacking.md b/docs/_stories/dns_hijacking.md index 6af5c024e2..250d2998bb 100644 --- a/docs/_stories/dns_hijacking.md +++ b/docs/_stories/dns_hijacking.md @@ -40,7 +40,7 @@ The searches in this Analytic Story help you detect and investigate activities t | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Clients Connecting to Multiple DNS Servers](/deprecated/clients_connecting_to_multiple_dns_servers/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol)| TTP | +| [Clients Connecting to Multiple DNS Servers](/deprecated/clients_connecting_to_multiple_dns_servers/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol)| TTP | | [DNS Query Requests Resolved by Unauthorized DNS Servers](/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers/) | [DNS](/tags/#dns)| TTP | | [DNS record changed](/deprecated/dns_record_changed/) | [DNS](/tags/#dns)| TTP | | [Detect hosts connecting to dynamic domain providers](/network/detect_hosts_connecting_to_dynamic_domain_providers/) | [Drive-by Compromise](/tags/#drive-by-compromise)| TTP | diff --git a/docs/_stories/hermetic_wiper.md b/docs/_stories/hermetic_wiper.md index 6bb9d1eb53..9aa678645f 100644 --- a/docs/_stories/hermetic_wiper.md +++ b/docs/_stories/hermetic_wiper.md @@ -70,7 +70,7 @@ Hermetic Wiper is destructive malware operation found by Sentinel One targeting | [Recon AVProduct Through Pwh or WMI](/endpoint/recon_avproduct_through_pwh_or_wmi/) | [Gather Victim Host Information](/tags/#gather-victim-host-information)| TTP | | [Recon Using WMI Class](/endpoint/recon_using_wmi_class/) | [Gather Victim Host Information](/tags/#gather-victim-host-information)| TTP | | [Registry Keys Used For Privilege Escalation](/endpoint/registry_keys_used_for_privilege_escalation/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Event Triggered Execution](/tags/#event-triggered-execution)| TTP | -| [Regsvr32 Silent and Install Param Dll Loading](/endpoint/regsvr32_silent_and_install_param_dll_loading/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| Anomaly | +| [Regsvr32 Silent and Install Param Dll Loading](/endpoint/regsvr32_silent_and_install_param_dll_loading/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| Anomaly | | [Runas Execution in CommandLine](/endpoint/runas_execution_in_commandline/) | [Access Token Manipulation](/tags/#access-token-manipulation), [Token Impersonation/Theft](/tags/#token-impersonation/theft)| Hunting | | [Screensaver Event Trigger Execution](/endpoint/screensaver_event_trigger_execution/) | [Event Triggered Execution](/tags/#event-triggered-execution), [Screensaver](/tags/#screensaver)| TTP | | [Set Default PowerShell Execution Policy To Unrestricted or Bypass](/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP | diff --git a/docs/_stories/hidden_cobra_malware.md b/docs/_stories/hidden_cobra_malware.md index f3c2694817..388a46e4df 100644 --- a/docs/_stories/hidden_cobra_malware.md +++ b/docs/_stories/hidden_cobra_malware.md @@ -46,7 +46,7 @@ Among other searches in this Analytic Story is a detection search that looks for | [Remote Desktop Network Traffic](/network/remote_desktop_network_traffic/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services)| Anomaly | | [SMB Traffic Spike](/network/smb_traffic_spike/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services)| Anomaly | | [SMB Traffic Spike - MLTK](/network/smb_traffic_spike_-_mltk/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services)| Anomaly | -| [DNS Query Length With High Standard Deviation](/network/dns_query_length_with_high_standard_deviation/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| Anomaly | +| [DNS Query Length With High Standard Deviation](/network/dns_query_length_with_high_standard_deviation/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| Anomaly | #### Reference diff --git a/docs/_stories/host_redirection.md b/docs/_stories/host_redirection.md index b977a8ef71..4ab74f8622 100644 --- a/docs/_stories/host_redirection.md +++ b/docs/_stories/host_redirection.md @@ -31,7 +31,7 @@ Attackers will often attempt to manipulate client communications for nefarious p | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Clients Connecting to Multiple DNS Servers](/deprecated/clients_connecting_to_multiple_dns_servers/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol)| TTP | +| [Clients Connecting to Multiple DNS Servers](/deprecated/clients_connecting_to_multiple_dns_servers/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol)| TTP | | [DNS Query Requests Resolved by Unauthorized DNS Servers](/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers/) | [DNS](/tags/#dns)| TTP | | [Windows hosts file modification](/deprecated/windows_hosts_file_modification/) | None| TTP | diff --git a/docs/_stories/icedid.md b/docs/_stories/icedid.md index f0ce4fd07b..a5153582c8 100644 --- a/docs/_stories/icedid.md +++ b/docs/_stories/icedid.md @@ -42,22 +42,22 @@ IcedId banking trojan campaigns targeting banks and other vertical sectors.This | [Eventvwr UAC Bypass](/endpoint/eventvwr_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP | | [FodHelper UAC Bypass](/endpoint/fodhelper_uac_bypass/) | [Modify Registry](/tags/#modify-registry), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP | | [IcedID Exfiltrated Archived File Creation](/endpoint/icedid_exfiltrated_archived_file_creation/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data)| Hunting | -| [Mshta spawning Rundll32 OR Regsvr32 Process](/endpoint/mshta_spawning_rundll32_or_regsvr32_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | +| [Mshta spawning Rundll32 OR Regsvr32 Process](/endpoint/mshta_spawning_rundll32_or_regsvr32_process/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | | [NLTest Domain Trust Discovery](/endpoint/nltest_domain_trust_discovery/) | [Domain Trust Discovery](/tags/#domain-trust-discovery)| TTP | | [Office Application Spawn Regsvr32 process](/endpoint/office_application_spawn_regsvr32_process/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP | | [Office Application Spawn rundll32 process](/endpoint/office_application_spawn_rundll32_process/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP | | [Office Document Executing Macro Code](/endpoint/office_document_executing_macro_code/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP | | [Office Product Spawning MSHTA](/endpoint/office_product_spawning_mshta/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP | | [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| TTP | -| [Regsvr32 with Known Silent Switch Cmdline](/endpoint/regsvr32_with_known_silent_switch_cmdline/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| Anomaly | +| [Regsvr32 with Known Silent Switch Cmdline](/endpoint/regsvr32_with_known_silent_switch_cmdline/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| Anomaly | | [Rundll32 Create Remote Thread To A Process](/endpoint/rundll32_create_remote_thread_to_a_process/) | [Process Injection](/tags/#process-injection)| TTP | | [Rundll32 CreateRemoteThread In Browser](/endpoint/rundll32_createremotethread_in_browser/) | [Process Injection](/tags/#process-injection)| TTP | -| [Rundll32 DNSQuery](/endpoint/rundll32_dnsquery/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | -| [Rundll32 Process Creating Exe Dll Files](/endpoint/rundll32_process_creating_exe_dll_files/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Rundll32 DNSQuery](/endpoint/rundll32_dnsquery/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Rundll32 Process Creating Exe Dll Files](/endpoint/rundll32_process_creating_exe_dll_files/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | | [Schedule Task with Rundll32 Command Trigger](/endpoint/schedule_task_with_rundll32_command_trigger/) | [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP | | [Sqlite Module In Temp Folder](/endpoint/sqlite_module_in_temp_folder/) | [Data from Local System](/tags/#data-from-local-system)| TTP | -| [Suspicious IcedID Rundll32 Cmdline](/endpoint/suspicious_icedid_rundll32_cmdline/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | -| [Suspicious Rundll32 PluginInit](/endpoint/suspicious_rundll32_plugininit/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Suspicious IcedID Rundll32 Cmdline](/endpoint/suspicious_icedid_rundll32_cmdline/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Suspicious Rundll32 PluginInit](/endpoint/suspicious_rundll32_plugininit/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | | [WinEvent Scheduled Task Created Within Public Path](/endpoint/winevent_scheduled_task_created_within_public_path/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP | | [WinEvent Windows Task Scheduler Event Action Started](/endpoint/winevent_windows_task_scheduler_event_action_started/) | [Scheduled Task](/tags/#scheduled-task)| Hunting | diff --git a/docs/_stories/insider_threat.md b/docs/_stories/insider_threat.md index 30913afb13..172fea6b8f 100644 --- a/docs/_stories/insider_threat.md +++ b/docs/_stories/insider_threat.md @@ -33,7 +33,7 @@ Insider Threats are best defined by CISA: "Insider threat incidents are possible | Name | Technique | Type | | ----------- | ----------- |--------------| | [Gsuite Drive Share In External Email](/cloud/gsuite_drive_share_in_external_email/) | [Exfiltration to Cloud Storage](/tags/#exfiltration-to-cloud-storage), [Exfiltration Over Web Service](/tags/#exfiltration-over-web-service)| Anomaly | -| [Gsuite Outbound Email With Attachment To External Domain](/cloud/gsuite_outbound_email_with_attachment_to_external_domain/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| Anomaly | +| [Gsuite Outbound Email With Attachment To External Domain](/cloud/gsuite_outbound_email_with_attachment_to_external_domain/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| Anomaly | | [High Frequency Copy Of Files In Network Share](/endpoint/high_frequency_copy_of_files_in_network_share/) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account)| Anomaly | | [Multiple Users Failing To Authenticate From Process](/endpoint/multiple_users_failing_to_authenticate_from_process/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force)| Anomaly | | [Windows Users Authenticate Using Explicit Credentials](/endpoint/windows_users_authenticate_using_explicit_credentials/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force)| Anomaly | diff --git a/docs/_stories/linux_persistence_techniques.md b/docs/_stories/linux_persistence_techniques.md index 0d13072c0a..c64cd93e45 100644 --- a/docs/_stories/linux_persistence_techniques.md +++ b/docs/_stories/linux_persistence_techniques.md @@ -35,7 +35,7 @@ Maintaining persistence is one of the first steps taken by attackers after the i | [Linux Add User Account](/endpoint/linux_add_user_account/) | [Local Account](/tags/#local-account), [Create Account](/tags/#create-account)| Hunting | | [Linux Adding Crontab Using List Parameter](/endpoint/linux_adding_crontab_using_list_parameter/) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job)| Hunting | | [Linux At Allow Config File Creation](/endpoint/linux_at_allow_config_file_creation/) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly | -| [Linux At Application Execution](/endpoint/linux_at_application_execution/) | [At (Linux)](/tags/#at-(linux)), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly | +| [Linux At Application Execution](/endpoint/linux_at_application_execution/) | [At](/tags/#at), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly | | [Linux Change File Owner To Root](/endpoint/linux_change_file_owner_to_root/) | [Linux and Mac File and Directory Permissions Modification](/tags/#linux-and-mac-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification)| Anomaly | | [Linux Common Process For Elevation Control](/endpoint/linux_common_process_for_elevation_control/) | [Setuid and Setgid](/tags/#setuid-and-setgid), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| Hunting | | [Linux Doas Conf File Creation](/endpoint/linux_doas_conf_file_creation/) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| Anomaly | @@ -50,7 +50,7 @@ Maintaining persistence is one of the first steps taken by attackers after the i | [Linux Possible Access Or Modification Of sshd Config File](/endpoint/linux_possible_access_or_modification_of_sshd_config_file/) | [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation)| Anomaly | | [Linux Possible Access To Credential Files](/endpoint/linux_possible_access_to_credential_files/) | [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping)| Anomaly | | [Linux Possible Access To Sudoers File](/endpoint/linux_possible_access_to_sudoers_file/) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| Anomaly | -| [Linux Possible Append Command To At Allow Config File](/endpoint/linux_possible_append_command_to_at_allow_config_file/) | [At (Linux)](/tags/#at-(linux)), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly | +| [Linux Possible Append Command To At Allow Config File](/endpoint/linux_possible_append_command_to_at_allow_config_file/) | [At](/tags/#at), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly | | [Linux Possible Append Command To Profile Config File](/endpoint/linux_possible_append_command_to_profile_config_file/) | [Unix Shell Configuration Modification](/tags/#unix-shell-configuration-modification), [Event Triggered Execution](/tags/#event-triggered-execution)| Anomaly | | [Linux Possible Append Cronjob Entry on Existing Cronjob File](/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file/) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job)| Hunting | | [Linux Possible Cronjob Modification With Editor](/endpoint/linux_possible_cronjob_modification_with_editor/) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job)| Hunting | diff --git a/docs/_stories/linux_privilege_escalation.md b/docs/_stories/linux_privilege_escalation.md index 8dad7ac60d..4c46eb4c93 100644 --- a/docs/_stories/linux_privilege_escalation.md +++ b/docs/_stories/linux_privilege_escalation.md @@ -35,7 +35,7 @@ Privilege escalation is a "land-and-expand" technique, wherein an adversary gain | [Linux Add User Account](/endpoint/linux_add_user_account/) | [Local Account](/tags/#local-account), [Create Account](/tags/#create-account)| Hunting | | [Linux Adding Crontab Using List Parameter](/endpoint/linux_adding_crontab_using_list_parameter/) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job)| Hunting | | [Linux At Allow Config File Creation](/endpoint/linux_at_allow_config_file_creation/) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly | -| [Linux At Application Execution](/endpoint/linux_at_application_execution/) | [At (Linux)](/tags/#at-(linux)), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly | +| [Linux At Application Execution](/endpoint/linux_at_application_execution/) | [At](/tags/#at), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly | | [Linux Change File Owner To Root](/endpoint/linux_change_file_owner_to_root/) | [Linux and Mac File and Directory Permissions Modification](/tags/#linux-and-mac-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification)| Anomaly | | [Linux Common Process For Elevation Control](/endpoint/linux_common_process_for_elevation_control/) | [Setuid and Setgid](/tags/#setuid-and-setgid), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| Hunting | | [Linux Doas Conf File Creation](/endpoint/linux_doas_conf_file_creation/) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| Anomaly | @@ -51,7 +51,7 @@ Privilege escalation is a "land-and-expand" technique, wherein an adversary gain | [Linux Possible Access Or Modification Of sshd Config File](/endpoint/linux_possible_access_or_modification_of_sshd_config_file/) | [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation)| Anomaly | | [Linux Possible Access To Credential Files](/endpoint/linux_possible_access_to_credential_files/) | [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping)| Anomaly | | [Linux Possible Access To Sudoers File](/endpoint/linux_possible_access_to_sudoers_file/) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| Anomaly | -| [Linux Possible Append Command To At Allow Config File](/endpoint/linux_possible_append_command_to_at_allow_config_file/) | [At (Linux)](/tags/#at-(linux)), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly | +| [Linux Possible Append Command To At Allow Config File](/endpoint/linux_possible_append_command_to_at_allow_config_file/) | [At](/tags/#at), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly | | [Linux Possible Append Command To Profile Config File](/endpoint/linux_possible_append_command_to_profile_config_file/) | [Unix Shell Configuration Modification](/tags/#unix-shell-configuration-modification), [Event Triggered Execution](/tags/#event-triggered-execution)| Anomaly | | [Linux Possible Append Cronjob Entry on Existing Cronjob File](/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file/) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job)| Hunting | | [Linux Possible Cronjob Modification With Editor](/endpoint/linux_possible_cronjob_modification_with_editor/) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job)| Hunting | diff --git a/docs/_stories/living_off_the_land.md b/docs/_stories/living_off_the_land.md index 1e9d595678..c3278cd696 100644 --- a/docs/_stories/living_off_the_land.md +++ b/docs/_stories/living_off_the_land.md @@ -40,74 +40,74 @@ Living Off The Land refers to an adversary methodology of using native applicati | [Certutil exe certificate extraction](/endpoint/certutil_exe_certificate_extraction/) | None| TTP | | [CertUtil With Decode Argument](/endpoint/certutil_with_decode_argument/) | [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information)| TTP | | [CMD Carry Out String Command Parameter](/endpoint/cmd_carry_out_string_command_parameter/) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Hunting | -| [Control Loading from World Writable Directory](/endpoint/control_loading_from_world_writable_directory/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Control Panel](/tags/#control-panel)| TTP | +| [Control Loading from World Writable Directory](/endpoint/control_loading_from_world_writable_directory/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Control Panel](/tags/#control-panel)| TTP | | [Creation of Shadow Copy with wmic and powershell](/endpoint/creation_of_shadow_copy_with_wmic_and_powershell/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping)| TTP | -| [Detect HTML Help Renamed](/endpoint/detect_html_help_renamed/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file)| Hunting | -| [Detect HTML Help Spawn Child Process](/endpoint/detect_html_help_spawn_child_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file)| TTP | -| [Detect HTML Help URL in Command Line](/endpoint/detect_html_help_url_in_command_line/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file)| TTP | -| [Detect HTML Help Using InfoTech Storage Handlers](/endpoint/detect_html_help_using_infotech_storage_handlers/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file)| TTP | -| [Detect mshta inline hta execution](/endpoint/detect_mshta_inline_hta_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | -| [Detect mshta renamed](/endpoint/detect_mshta_renamed/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta)| Hunting | -| [Detect MSHTA Url in Command Line](/endpoint/detect_mshta_url_in_command_line/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | -| [Detect Regasm Spawning a Process](/endpoint/detect_regasm_spawning_a_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | -| [Detect Regasm with Network Connection](/endpoint/detect_regasm_with_network_connection/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | -| [Detect Regasm with no Command Line Arguments](/endpoint/detect_regasm_with_no_command_line_arguments/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | -| [Detect Regsvcs Spawning a Process](/endpoint/detect_regsvcs_spawning_a_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | -| [Detect Regsvcs with Network Connection](/endpoint/detect_regsvcs_with_network_connection/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | -| [Detect Regsvcs with No Command Line Arguments](/endpoint/detect_regsvcs_with_no_command_line_arguments/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | -| [Detect Regsvr32 Application Control Bypass](/endpoint/detect_regsvr32_application_control_bypass/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| TTP | -| [Detect Rundll32 Application Control Bypass - advpack](/endpoint/detect_rundll32_application_control_bypass_-_advpack/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | -| [Detect Rundll32 Application Control Bypass - setupapi](/endpoint/detect_rundll32_application_control_bypass_-_setupapi/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | -| [Detect Rundll32 Application Control Bypass - syssetup](/endpoint/detect_rundll32_application_control_bypass_-_syssetup/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | -| [Detect Rundll32 Inline HTA Execution](/endpoint/detect_rundll32_inline_hta_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | +| [Detect HTML Help Renamed](/endpoint/detect_html_help_renamed/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file)| Hunting | +| [Detect HTML Help Spawn Child Process](/endpoint/detect_html_help_spawn_child_process/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file)| TTP | +| [Detect HTML Help URL in Command Line](/endpoint/detect_html_help_url_in_command_line/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file)| TTP | +| [Detect HTML Help Using InfoTech Storage Handlers](/endpoint/detect_html_help_using_infotech_storage_handlers/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file)| TTP | +| [Detect mshta inline hta execution](/endpoint/detect_mshta_inline_hta_execution/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | +| [Detect mshta renamed](/endpoint/detect_mshta_renamed/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta)| Hunting | +| [Detect MSHTA Url in Command Line](/endpoint/detect_mshta_url_in_command_line/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | +| [Detect Regasm Spawning a Process](/endpoint/detect_regasm_spawning_a_process/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | +| [Detect Regasm with Network Connection](/endpoint/detect_regasm_with_network_connection/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | +| [Detect Regasm with no Command Line Arguments](/endpoint/detect_regasm_with_no_command_line_arguments/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | +| [Detect Regsvcs Spawning a Process](/endpoint/detect_regsvcs_spawning_a_process/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | +| [Detect Regsvcs with Network Connection](/endpoint/detect_regsvcs_with_network_connection/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | +| [Detect Regsvcs with No Command Line Arguments](/endpoint/detect_regsvcs_with_no_command_line_arguments/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | +| [Detect Regsvr32 Application Control Bypass](/endpoint/detect_regsvr32_application_control_bypass/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| TTP | +| [Detect Rundll32 Application Control Bypass - advpack](/endpoint/detect_rundll32_application_control_bypass_-_advpack/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Detect Rundll32 Application Control Bypass - setupapi](/endpoint/detect_rundll32_application_control_bypass_-_setupapi/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Detect Rundll32 Application Control Bypass - syssetup](/endpoint/detect_rundll32_application_control_bypass_-_syssetup/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Detect Rundll32 Inline HTA Execution](/endpoint/detect_rundll32_inline_hta_execution/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | | [Disable Schedule Task](/endpoint/disable_schedule_task/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP | | [Dump LSASS via comsvcs DLL](/endpoint/dump_lsass_via_comsvcs_dll/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping)| TTP | | [Esentutl SAM Copy](/endpoint/esentutl_sam_copy/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping)| Hunting | | [Eventvwr UAC Bypass](/endpoint/eventvwr_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP | | [MacOS LOLbin](/endpoint/macos_lolbin/) | [Unix Shell](/tags/#unix-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| TTP | -| [MacOS plutil](/endpoint/macos_plutil/) | [Plist Modification](/tags/#plist-modification)| TTP | +| [MacOS plutil](/endpoint/macos_plutil/) | [Plist File Modification](/tags/#plist-file-modification)| TTP | | [Mmc LOLBAS Execution Process Spawn](/endpoint/mmc_lolbas_execution_process_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model)| TTP | -| [Mshta spawning Rundll32 OR Regsvr32 Process](/endpoint/mshta_spawning_rundll32_or_regsvr32_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | +| [Mshta spawning Rundll32 OR Regsvr32 Process](/endpoint/mshta_spawning_rundll32_or_regsvr32_process/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | | [Ntdsutil Export NTDS](/endpoint/ntdsutil_export_ntds/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping)| TTP | | [Reg exe Manipulating Windows Services Registry Keys](/endpoint/reg_exe_manipulating_windows_services_registry_keys/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Hijack Execution Flow](/tags/#hijack-execution-flow)| TTP | -| [Regsvr32 Silent and Install Param Dll Loading](/endpoint/regsvr32_silent_and_install_param_dll_loading/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| Anomaly | -| [Regsvr32 with Known Silent Switch Cmdline](/endpoint/regsvr32_with_known_silent_switch_cmdline/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| Anomaly | +| [Regsvr32 Silent and Install Param Dll Loading](/endpoint/regsvr32_silent_and_install_param_dll_loading/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| Anomaly | +| [Regsvr32 with Known Silent Switch Cmdline](/endpoint/regsvr32_with_known_silent_switch_cmdline/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| Anomaly | | [Remote WMI Command Attempt](/endpoint/remote_wmi_command_attempt/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation)| TTP | -| [Rundll32 Control RunDLL Hunt](/endpoint/rundll32_control_rundll_hunt/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| Hunting | -| [Rundll32 Control RunDLL World Writable Directory](/endpoint/rundll32_control_rundll_world_writable_directory/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Rundll32 Control RunDLL Hunt](/endpoint/rundll32_control_rundll_hunt/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| Hunting | +| [Rundll32 Control RunDLL World Writable Directory](/endpoint/rundll32_control_rundll_world_writable_directory/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | | [Rundll32 Create Remote Thread To A Process](/endpoint/rundll32_create_remote_thread_to_a_process/) | [Process Injection](/tags/#process-injection)| TTP | | [Rundll32 CreateRemoteThread In Browser](/endpoint/rundll32_createremotethread_in_browser/) | [Process Injection](/tags/#process-injection)| TTP | -| [Rundll32 DNSQuery](/endpoint/rundll32_dnsquery/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | -| [Rundll32 Process Creating Exe Dll Files](/endpoint/rundll32_process_creating_exe_dll_files/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Rundll32 DNSQuery](/endpoint/rundll32_dnsquery/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Rundll32 Process Creating Exe Dll Files](/endpoint/rundll32_process_creating_exe_dll_files/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | | [Rundll32 Shimcache Flush](/endpoint/rundll32_shimcache_flush/) | [Modify Registry](/tags/#modify-registry)| TTP | -| [RunDLL Loading DLL By Ordinal](/endpoint/rundll_loading_dll_by_ordinal/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [RunDLL Loading DLL By Ordinal](/endpoint/rundll_loading_dll_by_ordinal/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | | [Schedule Task with HTTP Command Arguments](/endpoint/schedule_task_with_http_command_arguments/) | [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP | | [Schedule Task with Rundll32 Command Trigger](/endpoint/schedule_task_with_rundll32_command_trigger/) | [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP | -| [Scheduled Task Creation on Remote Endpoint using At](/endpoint/scheduled_task_creation_on_remote_endpoint_using_at/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [At (Windows)](/tags/#at-(windows))| TTP | +| [Scheduled Task Creation on Remote Endpoint using At](/endpoint/scheduled_task_creation_on_remote_endpoint_using_at/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [At](/tags/#at)| TTP | | [Scheduled Task Deleted Or Created via CMD](/endpoint/scheduled_task_deleted_or_created_via_cmd/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP | | [Scheduled Task Initiation on Remote Endpoint](/endpoint/scheduled_task_initiation_on_remote_endpoint/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Scheduled Task](/tags/#scheduled-task)| TTP | | [Schtasks scheduling job on remote system](/endpoint/schtasks_scheduling_job_on_remote_system/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP | | [Services LOLBAS Execution Process Spawn](/endpoint/services_lolbas_execution_process_spawn/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service)| TTP | -| [Suspicious IcedID Rundll32 Cmdline](/endpoint/suspicious_icedid_rundll32_cmdline/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Suspicious IcedID Rundll32 Cmdline](/endpoint/suspicious_icedid_rundll32_cmdline/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | | [Suspicious microsoft workflow compiler rename](/endpoint/suspicious_microsoft_workflow_compiler_rename/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities)| Hunting | | [Suspicious microsoft workflow compiler usage](/endpoint/suspicious_microsoft_workflow_compiler_usage/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution)| TTP | | [Suspicious msbuild path](/endpoint/suspicious_msbuild_path/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild)| TTP | | [Suspicious MSBuild Rename](/endpoint/suspicious_msbuild_rename/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild)| Hunting | | [Suspicious MSBuild Spawn](/endpoint/suspicious_msbuild_spawn/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [MSBuild](/tags/#msbuild)| TTP | -| [Suspicious mshta child process](/endpoint/suspicious_mshta_child_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | -| [Suspicious mshta spawn](/endpoint/suspicious_mshta_spawn/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | -| [Suspicious Regsvr32 Register Suspicious Path](/endpoint/suspicious_regsvr32_register_suspicious_path/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| TTP | -| [Suspicious Rundll32 dllregisterserver](/endpoint/suspicious_rundll32_dllregisterserver/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Suspicious mshta child process](/endpoint/suspicious_mshta_child_process/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | +| [Suspicious mshta spawn](/endpoint/suspicious_mshta_spawn/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | +| [Suspicious Regsvr32 Register Suspicious Path](/endpoint/suspicious_regsvr32_register_suspicious_path/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| TTP | +| [Suspicious Rundll32 dllregisterserver](/endpoint/suspicious_rundll32_dllregisterserver/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | | [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly | | [Svchost LOLBAS Execution Process Spawn](/endpoint/svchost_lolbas_execution_process_spawn/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Scheduled Task](/tags/#scheduled-task)| TTP | -| [Windows Diskshadow Proxy Execution](/endpoint/windows_diskshadow_proxy_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution)| TTP | +| [Windows Diskshadow Proxy Execution](/endpoint/windows_diskshadow_proxy_execution/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution)| TTP | | [Windows Indirect Command Execution Via forfiles](/endpoint/windows_indirect_command_execution_via_forfiles/) | [Indirect Command Execution](/tags/#indirect-command-execution)| TTP | | [Windows Indirect Command Execution Via pcalua](/endpoint/windows_indirect_command_execution_via_pcalua/) | [Indirect Command Execution](/tags/#indirect-command-execution)| TTP | -| [Windows InstallUtil in Non Standard Path](/endpoint/windows_installutil_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP | -| [Windows InstallUtil Remote Network Connection](/endpoint/windows_installutil_remote_network_connection/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution)| TTP | -| [Windows InstallUtil Uninstall Option](/endpoint/windows_installutil_uninstall_option/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution)| TTP | -| [Windows InstallUtil Uninstall Option with Network](/endpoint/windows_installutil_uninstall_option_with_network/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution)| TTP | -| [Windows InstallUtil URL in Command Line](/endpoint/windows_installutil_url_in_command_line/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution)| TTP | +| [Windows InstallUtil in Non Standard Path](/endpoint/windows_installutil_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP | +| [Windows InstallUtil Remote Network Connection](/endpoint/windows_installutil_remote_network_connection/) | [InstallUtil](/tags/#installutil), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution)| TTP | +| [Windows InstallUtil Uninstall Option](/endpoint/windows_installutil_uninstall_option/) | [InstallUtil](/tags/#installutil), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution)| TTP | +| [Windows InstallUtil Uninstall Option with Network](/endpoint/windows_installutil_uninstall_option_with_network/) | [InstallUtil](/tags/#installutil), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution)| TTP | +| [Windows InstallUtil URL in Command Line](/endpoint/windows_installutil_url_in_command_line/) | [InstallUtil](/tags/#installutil), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution)| TTP | | [WSReset UAC Bypass](/endpoint/wsreset_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP | #### Reference diff --git a/docs/_stories/masquerading_-_rename_system_utilities.md b/docs/_stories/masquerading_-_rename_system_utilities.md index b59b0fc547..4119989902 100644 --- a/docs/_stories/masquerading_-_rename_system_utilities.md +++ b/docs/_stories/masquerading_-_rename_system_utilities.md @@ -35,15 +35,15 @@ There will be false positives as some native Windows processes are moved or ran | Name | Technique | Type | | ----------- | ----------- |--------------| | [Execution of File With Spaces Before Extension](/deprecated/execution_of_file_with_spaces_before_extension/) | [Rename System Utilities](/tags/#rename-system-utilities)| TTP | -| [Suspicious Rundll32 Rename](/deprecated/suspicious_rundll32_rename/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Masquerading](/tags/#masquerading), [Rundll32](/tags/#rundll32), [Rename System Utilities](/tags/#rename-system-utilities)| Hunting | +| [Suspicious Rundll32 Rename](/deprecated/suspicious_rundll32_rename/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Masquerading](/tags/#masquerading), [Rundll32](/tags/#rundll32), [Rename System Utilities](/tags/#rename-system-utilities)| Hunting | | [Execution of File with Multiple Extensions](/endpoint/execution_of_file_with_multiple_extensions/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities)| TTP | | [Sdelete Application Execution](/endpoint/sdelete_application_execution/) | [Data Destruction](/tags/#data-destruction), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host)| TTP | | [Suspicious microsoft workflow compiler rename](/endpoint/suspicious_microsoft_workflow_compiler_rename/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities)| Hunting | | [Suspicious msbuild path](/endpoint/suspicious_msbuild_path/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild)| TTP | | [Suspicious MSBuild Rename](/endpoint/suspicious_msbuild_rename/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild)| Hunting | | [System Processes Run From Unexpected Locations](/endpoint/system_processes_run_from_unexpected_locations/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities)| TTP | -| [Windows DotNet Binary in Non Standard Path](/endpoint/windows_dotnet_binary_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP | -| [Windows InstallUtil in Non Standard Path](/endpoint/windows_installutil_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP | +| [Windows DotNet Binary in Non Standard Path](/endpoint/windows_dotnet_binary_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP | +| [Windows InstallUtil in Non Standard Path](/endpoint/windows_installutil_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP | #### Reference diff --git a/docs/_stories/microsoft_mshtml_remote_code_execution_cve-2021-40444.md b/docs/_stories/microsoft_mshtml_remote_code_execution_cve-2021-40444.md index 08bab42fcb..78e4530140 100644 --- a/docs/_stories/microsoft_mshtml_remote_code_execution_cve-2021-40444.md +++ b/docs/_stories/microsoft_mshtml_remote_code_execution_cve-2021-40444.md @@ -32,12 +32,12 @@ Microsoft is aware of targeted attacks that attempt to exploit this vulnerabilit | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Control Loading from World Writable Directory](/endpoint/control_loading_from_world_writable_directory/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Control Panel](/tags/#control-panel)| TTP | +| [Control Loading from World Writable Directory](/endpoint/control_loading_from_world_writable_directory/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Control Panel](/tags/#control-panel)| TTP | | [MSHTML Module Load in Office Product](/endpoint/mshtml_module_load_in_office_product/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP | | [Office Product Writing cab or inf](/endpoint/office_product_writing_cab_or_inf/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP | | [Office Spawning Control](/endpoint/office_spawning_control/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP | -| [Rundll32 Control RunDLL Hunt](/endpoint/rundll32_control_rundll_hunt/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| Hunting | -| [Rundll32 Control RunDLL World Writable Directory](/endpoint/rundll32_control_rundll_world_writable_directory/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Rundll32 Control RunDLL Hunt](/endpoint/rundll32_control_rundll_hunt/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| Hunting | +| [Rundll32 Control RunDLL World Writable Directory](/endpoint/rundll32_control_rundll_world_writable_directory/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | #### Reference diff --git a/docs/_stories/nobelium_group.md b/docs/_stories/nobelium_group.md index 70bb404dcf..30e74e117b 100644 --- a/docs/_stories/nobelium_group.md +++ b/docs/_stories/nobelium_group.md @@ -38,7 +38,7 @@ This Analytic Story supports you to detect Tactics, Techniques and Procedures (T | ----------- | ----------- |--------------| | [Anomalous usage of 7zip](/endpoint/anomalous_usage_of_7zip/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data)| Anomaly | | [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell)| Hunting | -| [Detect Rundll32 Inline HTA Execution](/endpoint/detect_rundll32_inline_hta_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | +| [Detect Rundll32 Inline HTA Execution](/endpoint/detect_rundll32_inline_hta_execution/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | | [Malicious PowerShell Process - Encoded Command](/endpoint/malicious_powershell_process_-_encoded_command/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information)| Hunting | | [Sc exe Manipulating Windows Services](/endpoint/sc_exe_manipulating_windows_services/) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process)| TTP | | [Scheduled Task Deleted Or Created via CMD](/endpoint/scheduled_task_deleted_or_created_via_cmd/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP | diff --git a/docs/_stories/printnightmare_cve-2021-34527.md b/docs/_stories/printnightmare_cve-2021-34527.md index 9e65e61144..c54e58d307 100644 --- a/docs/_stories/printnightmare_cve-2021-34527.md +++ b/docs/_stories/printnightmare_cve-2021-34527.md @@ -39,13 +39,13 @@ In the most impactful scenario, an attacker would be able to leverage this vulne | ----------- | ----------- |--------------| | [Print Spooler Adding A Printer Driver](/endpoint/print_spooler_adding_a_printer_driver/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| TTP | | [Print Spooler Failed to Load a Plug-in](/endpoint/print_spooler_failed_to_load_a_plug-in/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| TTP | -| [Rundll32 with no Command Line Arguments with Network](/endpoint/rundll32_with_no_command_line_arguments_with_network/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Rundll32 with no Command Line Arguments with Network](/endpoint/rundll32_with_no_command_line_arguments_with_network/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | | [Spoolsv Spawning Rundll32](/endpoint/spoolsv_spawning_rundll32/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| TTP | | [Spoolsv Suspicious Loaded Modules](/endpoint/spoolsv_suspicious_loaded_modules/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| TTP | | [Spoolsv Suspicious Process Access](/endpoint/spoolsv_suspicious_process_access/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation)| TTP | | [Spoolsv Writing a DLL](/endpoint/spoolsv_writing_a_dll/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| TTP | | [Spoolsv Writing a DLL - Sysmon](/endpoint/spoolsv_writing_a_dll_-_sysmon/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| TTP | -| [Suspicious Rundll32 no Command Line Arguments](/endpoint/suspicious_rundll32_no_command_line_arguments/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Suspicious Rundll32 no Command Line Arguments](/endpoint/suspicious_rundll32_no_command_line_arguments/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | #### Reference diff --git a/docs/_stories/prohibited_traffic_allowed_or_protocol_mismatch.md b/docs/_stories/prohibited_traffic_allowed_or_protocol_mismatch.md index 8ddb30c408..0424770478 100644 --- a/docs/_stories/prohibited_traffic_allowed_or_protocol_mismatch.md +++ b/docs/_stories/prohibited_traffic_allowed_or_protocol_mismatch.md @@ -40,7 +40,7 @@ A traditional security best practice is to control the ports, protocols, and ser | [Allow Inbound Traffic In Firewall Rule](/endpoint/allow_inbound_traffic_in_firewall_rule/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services)| TTP | | [Enable RDP In Other Port Number](/endpoint/enable_rdp_in_other_port_number/) | [Remote Services](/tags/#remote-services)| TTP | | [Prohibited Network Traffic Allowed](/network/prohibited_network_traffic_allowed/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| TTP | -| [Protocol or Port Mismatch](/network/protocol_or_port_mismatch/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| Anomaly | +| [Protocol or Port Mismatch](/network/protocol_or_port_mismatch/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| Anomaly | | [TOR Traffic](/network/tor_traffic/) | [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols)| TTP | | [Detect hosts connecting to dynamic domain providers](/network/detect_hosts_connecting_to_dynamic_domain_providers/) | [Drive-by Compromise](/tags/#drive-by-compromise)| TTP | diff --git a/docs/_stories/ransomware.md b/docs/_stories/ransomware.md index 0ccde941fb..5f9dbd9469 100644 --- a/docs/_stories/ransomware.md +++ b/docs/_stories/ransomware.md @@ -43,7 +43,7 @@ Ransomware is an ever-present risk to the enterprise, wherein an infected host e | [Allow Operation with Consent Admin](/endpoint/allow_operation_with_consent_admin/) | [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP | | [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery)| TTP | | [Clear Unallocated Sector Using Cipher App](/endpoint/clear_unallocated_sector_using_cipher_app/) | [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host)| TTP | -| [CMLUA Or CMSTPLUA UAC Bypass](/endpoint/cmlua_or_cmstplua_uac_bypass/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp)| TTP | +| [CMLUA Or CMSTPLUA UAC Bypass](/endpoint/cmlua_or_cmstplua_uac_bypass/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [CMSTP](/tags/#cmstp)| TTP | | [Common Ransomware Extensions](/endpoint/common_ransomware_extensions/) | [Data Destruction](/tags/#data-destruction)| Hunting | | [Common Ransomware Notes](/endpoint/common_ransomware_notes/) | [Data Destruction](/tags/#data-destruction)| Hunting | | [Conti Common Exec parameter](/endpoint/conti_common_exec_parameter/) | [User Execution](/tags/#user-execution)| TTP | @@ -83,11 +83,11 @@ Ransomware is an ever-present risk to the enterprise, wherein an infected host e | [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly | | [Suspicious wevtutil Usage](/endpoint/suspicious_wevtutil_usage/) | [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Indicator Removal on Host](/tags/#indicator-removal-on-host)| TTP | | [System Processes Run From Unexpected Locations](/endpoint/system_processes_run_from_unexpected_locations/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities)| TTP | -| [UAC Bypass With Colorui COM Object](/endpoint/uac_bypass_with_colorui_com_object/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp)| TTP | -| [Uninstall App Using MsiExec](/endpoint/uninstall_app_using_msiexec/) | [Msiexec](/tags/#msiexec), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution)| TTP | +| [UAC Bypass With Colorui COM Object](/endpoint/uac_bypass_with_colorui_com_object/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [CMSTP](/tags/#cmstp)| TTP | +| [Uninstall App Using MsiExec](/endpoint/uninstall_app_using_msiexec/) | [Msiexec](/tags/#msiexec), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution)| TTP | | [USN Journal Deletion](/endpoint/usn_journal_deletion/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host)| TTP | | [WBAdmin Delete System Backups](/endpoint/wbadmin_delete_system_backups/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery)| TTP | -| [Wbemprox COM Object Execution](/endpoint/wbemprox_com_object_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp)| TTP | +| [Wbemprox COM Object Execution](/endpoint/wbemprox_com_object_execution/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [CMSTP](/tags/#cmstp)| TTP | | [Windows Disable Change Password Through Registry](/endpoint/windows_disable_change_password_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly | | [Windows Disable Lock Workstation Feature Through Registry](/endpoint/windows_disable_lock_workstation_feature_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly | | [Windows Disable LogOff Button Through Registry](/endpoint/windows_disable_logoff_button_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly | @@ -95,10 +95,10 @@ Ransomware is an ever-present risk to the enterprise, wherein an infected host e | [Windows Disable Shutdown Button Through Registry](/endpoint/windows_disable_shutdown_button_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly | | [Windows Disable Windows Group Policy Features Through Registry](/endpoint/windows_disable_windows_group_policy_features_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly | | [Windows DiskCryptor Usage](/endpoint/windows_diskcryptor_usage/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact)| Hunting | -| [Windows DotNet Binary in Non Standard Path](/endpoint/windows_dotnet_binary_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP | +| [Windows DotNet Binary in Non Standard Path](/endpoint/windows_dotnet_binary_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP | | [Windows Event Log Cleared](/endpoint/windows_event_log_cleared/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs)| TTP | | [Windows Hide Notification Features Through Registry](/endpoint/windows_hide_notification_features_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly | -| [Windows InstallUtil in Non Standard Path](/endpoint/windows_installutil_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP | +| [Windows InstallUtil in Non Standard Path](/endpoint/windows_installutil_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP | | [Windows NirSoft AdvancedRun](/endpoint/windows_nirsoft_advancedrun/) | [Tool](/tags/#tool)| TTP | | [Windows Raccine Scheduled Task Deletion](/endpoint/windows_raccine_scheduled_task_deletion/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools)| TTP | | [Windows Registry Modification for Safe Mode Persistence](/endpoint/windows_registry_modification_for_safe_mode_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| TTP | diff --git a/docs/_stories/remcos.md b/docs/_stories/remcos.md index aad8b0f1e3..2c7fd4b3eb 100644 --- a/docs/_stories/remcos.md +++ b/docs/_stories/remcos.md @@ -46,8 +46,8 @@ Remcos or Remote Control and Surveillance, marketed as a legitimate software for | [Process Deleting Its Process File Path](/endpoint/process_deleting_its_process_file_path/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host)| TTP | | [Process Writing DynamicWrapperX](/endpoint/process_writing_dynamicwrapperx/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Component Object Model](/tags/#component-object-model)| Hunting | | [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| TTP | -| [Regsvr32 Silent and Install Param Dll Loading](/endpoint/regsvr32_silent_and_install_param_dll_loading/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| Anomaly | -| [Regsvr32 with Known Silent Switch Cmdline](/endpoint/regsvr32_with_known_silent_switch_cmdline/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| Anomaly | +| [Regsvr32 Silent and Install Param Dll Loading](/endpoint/regsvr32_silent_and_install_param_dll_loading/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| Anomaly | +| [Regsvr32 with Known Silent Switch Cmdline](/endpoint/regsvr32_with_known_silent_switch_cmdline/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| Anomaly | | [Remcos client registry install entry](/endpoint/remcos_client_registry_install_entry/) | [Modify Registry](/tags/#modify-registry)| TTP | | [Remcos RAT File Creation in Remcos Folder](/endpoint/remcos_rat_file_creation_in_remcos_folder/) | [Screen Capture](/tags/#screen-capture)| TTP | | [Suspicious Image Creation In Appdata Folder](/endpoint/suspicious_image_creation_in_appdata_folder/) | [Screen Capture](/tags/#screen-capture)| TTP | diff --git a/docs/_stories/revil_ransomware.md b/docs/_stories/revil_ransomware.md index 5b7f44a7ac..be227dbe79 100644 --- a/docs/_stories/revil_ransomware.md +++ b/docs/_stories/revil_ransomware.md @@ -39,7 +39,7 @@ Revil ransomware is a RaaS,that a single group may operates and manges the devel | [Powershell Disable Security Monitoring](/endpoint/powershell_disable_security_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP | | [Revil Common Exec Parameter](/endpoint/revil_common_exec_parameter/) | [User Execution](/tags/#user-execution)| TTP | | [Revil Registry Entry](/endpoint/revil_registry_entry/) | [Modify Registry](/tags/#modify-registry)| TTP | -| [Wbemprox COM Object Execution](/endpoint/wbemprox_com_object_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp)| TTP | +| [Wbemprox COM Object Execution](/endpoint/wbemprox_com_object_execution/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [CMSTP](/tags/#cmstp)| TTP | #### Reference diff --git a/docs/_stories/signed_binary_proxy_execution_installutil.md b/docs/_stories/signed_binary_proxy_execution_installutil.md index defda50183..c1906641e2 100644 --- a/docs/_stories/signed_binary_proxy_execution_installutil.md +++ b/docs/_stories/signed_binary_proxy_execution_installutil.md @@ -35,13 +35,13 @@ Parallel processes may also include csc.exe being used to compile a local `.cs` | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Windows DotNet Binary in Non Standard Path](/endpoint/windows_dotnet_binary_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP | -| [Windows InstallUtil Credential Theft](/endpoint/windows_installutil_credential_theft/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution)| TTP | -| [Windows InstallUtil in Non Standard Path](/endpoint/windows_installutil_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP | -| [Windows InstallUtil Remote Network Connection](/endpoint/windows_installutil_remote_network_connection/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution)| TTP | -| [Windows InstallUtil Uninstall Option](/endpoint/windows_installutil_uninstall_option/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution)| TTP | -| [Windows InstallUtil Uninstall Option with Network](/endpoint/windows_installutil_uninstall_option_with_network/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution)| TTP | -| [Windows InstallUtil URL in Command Line](/endpoint/windows_installutil_url_in_command_line/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution)| TTP | +| [Windows DotNet Binary in Non Standard Path](/endpoint/windows_dotnet_binary_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP | +| [Windows InstallUtil Credential Theft](/endpoint/windows_installutil_credential_theft/) | [InstallUtil](/tags/#installutil), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution)| TTP | +| [Windows InstallUtil in Non Standard Path](/endpoint/windows_installutil_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP | +| [Windows InstallUtil Remote Network Connection](/endpoint/windows_installutil_remote_network_connection/) | [InstallUtil](/tags/#installutil), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution)| TTP | +| [Windows InstallUtil Uninstall Option](/endpoint/windows_installutil_uninstall_option/) | [InstallUtil](/tags/#installutil), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution)| TTP | +| [Windows InstallUtil Uninstall Option with Network](/endpoint/windows_installutil_uninstall_option_with_network/) | [InstallUtil](/tags/#installutil), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution)| TTP | +| [Windows InstallUtil URL in Command Line](/endpoint/windows_installutil_url_in_command_line/) | [InstallUtil](/tags/#installutil), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution)| TTP | #### Reference diff --git a/docs/_stories/suspicious_compiled_html_activity.md b/docs/_stories/suspicious_compiled_html_activity.md index 20545d8fef..a66ceec586 100644 --- a/docs/_stories/suspicious_compiled_html_activity.md +++ b/docs/_stories/suspicious_compiled_html_activity.md @@ -34,10 +34,10 @@ Upon usage of InfoTech Storage Handlers, ms-its, its, mk, itss.dll will load. | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect HTML Help Renamed](/endpoint/detect_html_help_renamed/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file)| Hunting | -| [Detect HTML Help Spawn Child Process](/endpoint/detect_html_help_spawn_child_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file)| TTP | -| [Detect HTML Help URL in Command Line](/endpoint/detect_html_help_url_in_command_line/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file)| TTP | -| [Detect HTML Help Using InfoTech Storage Handlers](/endpoint/detect_html_help_using_infotech_storage_handlers/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file)| TTP | +| [Detect HTML Help Renamed](/endpoint/detect_html_help_renamed/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file)| Hunting | +| [Detect HTML Help Spawn Child Process](/endpoint/detect_html_help_spawn_child_process/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file)| TTP | +| [Detect HTML Help URL in Command Line](/endpoint/detect_html_help_url_in_command_line/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file)| TTP | +| [Detect HTML Help Using InfoTech Storage Handlers](/endpoint/detect_html_help_using_infotech_storage_handlers/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file)| TTP | #### Reference diff --git a/docs/_stories/suspicious_dns_traffic.md b/docs/_stories/suspicious_dns_traffic.md index 6fd280cede..427fd5c281 100644 --- a/docs/_stories/suspicious_dns_traffic.md +++ b/docs/_stories/suspicious_dns_traffic.md @@ -34,16 +34,16 @@ Although DNS is one of the fundamental underlying protocols that make the Intern | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Clients Connecting to Multiple DNS Servers](/deprecated/clients_connecting_to_multiple_dns_servers/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol)| TTP | -| [Detect Long DNS TXT Record Response](/deprecated/detect_long_dns_txt_record_response/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol)| TTP | -| [Detection of DNS Tunnels](/deprecated/detection_of_dns_tunnels/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol)| TTP | +| [Clients Connecting to Multiple DNS Servers](/deprecated/clients_connecting_to_multiple_dns_servers/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol)| TTP | +| [Detect Long DNS TXT Record Response](/deprecated/detect_long_dns_txt_record_response/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol)| TTP | +| [Detection of DNS Tunnels](/deprecated/detection_of_dns_tunnels/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol)| TTP | | [DNS Query Requests Resolved by Unauthorized DNS Servers](/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers/) | [DNS](/tags/#dns)| TTP | | [DNS Exfiltration Using Nslookup App](/endpoint/dns_exfiltration_using_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| TTP | | [Excessive Usage of NSLOOKUP App](/endpoint/excessive_usage_of_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| Anomaly | | [DNS Query Length Outliers - MLTK](/network/dns_query_length_outliers_-_mltk/) | [DNS](/tags/#dns), [Application Layer Protocol](/tags/#application-layer-protocol)| Anomaly | | [Excessive DNS Failures](/network/excessive_dns_failures/) | [DNS](/tags/#dns), [Application Layer Protocol](/tags/#application-layer-protocol)| Anomaly | | [Detect hosts connecting to dynamic domain providers](/network/detect_hosts_connecting_to_dynamic_domain_providers/) | [Drive-by Compromise](/tags/#drive-by-compromise)| TTP | -| [DNS Query Length With High Standard Deviation](/network/dns_query_length_with_high_standard_deviation/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| Anomaly | +| [DNS Query Length With High Standard Deviation](/network/dns_query_length_with_high_standard_deviation/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol)| Anomaly | #### Reference diff --git a/docs/_stories/suspicious_mshta_activity.md b/docs/_stories/suspicious_mshta_activity.md index af0f492673..c69daf5ef9 100644 --- a/docs/_stories/suspicious_mshta_activity.md +++ b/docs/_stories/suspicious_mshta_activity.md @@ -44,14 +44,14 @@ The objective of this step is to confirm the executed script code is benign or m | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect mshta inline hta execution](/endpoint/detect_mshta_inline_hta_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | -| [Detect mshta renamed](/endpoint/detect_mshta_renamed/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta)| Hunting | -| [Detect MSHTA Url in Command Line](/endpoint/detect_mshta_url_in_command_line/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | +| [Detect mshta inline hta execution](/endpoint/detect_mshta_inline_hta_execution/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | +| [Detect mshta renamed](/endpoint/detect_mshta_renamed/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta)| Hunting | +| [Detect MSHTA Url in Command Line](/endpoint/detect_mshta_url_in_command_line/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | | [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell)| Hunting | -| [Detect Rundll32 Inline HTA Execution](/endpoint/detect_rundll32_inline_hta_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | +| [Detect Rundll32 Inline HTA Execution](/endpoint/detect_rundll32_inline_hta_execution/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | | [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| TTP | -| [Suspicious mshta child process](/endpoint/suspicious_mshta_child_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | -| [Suspicious mshta spawn](/endpoint/suspicious_mshta_spawn/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | +| [Suspicious mshta child process](/endpoint/suspicious_mshta_child_process/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | +| [Suspicious mshta spawn](/endpoint/suspicious_mshta_spawn/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | #### Reference diff --git a/docs/_stories/suspicious_regsvcs_regasm_activity.md b/docs/_stories/suspicious_regsvcs_regasm_activity.md index 1e4e9a29e9..348fe881a1 100644 --- a/docs/_stories/suspicious_regsvcs_regasm_activity.md +++ b/docs/_stories/suspicious_regsvcs_regasm_activity.md @@ -31,12 +31,12 @@ Monitor and detect techniques used by attackers who leverage the mshta.exe proce | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect Regasm Spawning a Process](/endpoint/detect_regasm_spawning_a_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | -| [Detect Regasm with Network Connection](/endpoint/detect_regasm_with_network_connection/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | -| [Detect Regasm with no Command Line Arguments](/endpoint/detect_regasm_with_no_command_line_arguments/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | -| [Detect Regsvcs Spawning a Process](/endpoint/detect_regsvcs_spawning_a_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | -| [Detect Regsvcs with Network Connection](/endpoint/detect_regsvcs_with_network_connection/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | -| [Detect Regsvcs with No Command Line Arguments](/endpoint/detect_regsvcs_with_no_command_line_arguments/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | +| [Detect Regasm Spawning a Process](/endpoint/detect_regasm_spawning_a_process/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | +| [Detect Regasm with Network Connection](/endpoint/detect_regasm_with_network_connection/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | +| [Detect Regasm with no Command Line Arguments](/endpoint/detect_regasm_with_no_command_line_arguments/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | +| [Detect Regsvcs Spawning a Process](/endpoint/detect_regsvcs_spawning_a_process/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | +| [Detect Regsvcs with Network Connection](/endpoint/detect_regsvcs_with_network_connection/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | +| [Detect Regsvcs with No Command Line Arguments](/endpoint/detect_regsvcs_with_no_command_line_arguments/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | #### Reference diff --git a/docs/_stories/suspicious_regsvr32_activity.md b/docs/_stories/suspicious_regsvr32_activity.md index 899fb9bb26..bd5882e26b 100644 --- a/docs/_stories/suspicious_regsvr32_activity.md +++ b/docs/_stories/suspicious_regsvr32_activity.md @@ -32,11 +32,11 @@ One common adversary tactic is to bypass application control solutions via the r | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Detect Regsvr32 Application Control Bypass](/endpoint/detect_regsvr32_application_control_bypass/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| TTP | +| [Detect Regsvr32 Application Control Bypass](/endpoint/detect_regsvr32_application_control_bypass/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| TTP | | [Malicious InProcServer32 Modification](/endpoint/malicious_inprocserver32_modification/) | [Regsvr32](/tags/#regsvr32), [Modify Registry](/tags/#modify-registry)| TTP | -| [Regsvr32 Silent and Install Param Dll Loading](/endpoint/regsvr32_silent_and_install_param_dll_loading/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| Anomaly | -| [Regsvr32 with Known Silent Switch Cmdline](/endpoint/regsvr32_with_known_silent_switch_cmdline/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| Anomaly | -| [Suspicious Regsvr32 Register Suspicious Path](/endpoint/suspicious_regsvr32_register_suspicious_path/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| TTP | +| [Regsvr32 Silent and Install Param Dll Loading](/endpoint/regsvr32_silent_and_install_param_dll_loading/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| Anomaly | +| [Regsvr32 with Known Silent Switch Cmdline](/endpoint/regsvr32_with_known_silent_switch_cmdline/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| Anomaly | +| [Suspicious Regsvr32 Register Suspicious Path](/endpoint/suspicious_regsvr32_register_suspicious_path/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| TTP | #### Reference diff --git a/docs/_stories/suspicious_rundll32_activity.md b/docs/_stories/suspicious_rundll32_activity.md index 1268213d20..24e21a3e9d 100644 --- a/docs/_stories/suspicious_rundll32_activity.md +++ b/docs/_stories/suspicious_rundll32_activity.md @@ -33,18 +33,18 @@ One common adversary tactic is to bypass application control solutions via the r | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Suspicious Rundll32 Rename](/deprecated/suspicious_rundll32_rename/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Masquerading](/tags/#masquerading), [Rundll32](/tags/#rundll32), [Rename System Utilities](/tags/#rename-system-utilities)| Hunting | -| [Detect Rundll32 Application Control Bypass - advpack](/endpoint/detect_rundll32_application_control_bypass_-_advpack/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | -| [Detect Rundll32 Application Control Bypass - setupapi](/endpoint/detect_rundll32_application_control_bypass_-_setupapi/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | -| [Detect Rundll32 Application Control Bypass - syssetup](/endpoint/detect_rundll32_application_control_bypass_-_syssetup/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Suspicious Rundll32 Rename](/deprecated/suspicious_rundll32_rename/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Masquerading](/tags/#masquerading), [Rundll32](/tags/#rundll32), [Rename System Utilities](/tags/#rename-system-utilities)| Hunting | +| [Detect Rundll32 Application Control Bypass - advpack](/endpoint/detect_rundll32_application_control_bypass_-_advpack/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Detect Rundll32 Application Control Bypass - setupapi](/endpoint/detect_rundll32_application_control_bypass_-_setupapi/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Detect Rundll32 Application Control Bypass - syssetup](/endpoint/detect_rundll32_application_control_bypass_-_syssetup/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | | [Dump LSASS via comsvcs DLL](/endpoint/dump_lsass_via_comsvcs_dll/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping)| TTP | -| [Rundll32 Control RunDLL Hunt](/endpoint/rundll32_control_rundll_hunt/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| Hunting | -| [Rundll32 Control RunDLL World Writable Directory](/endpoint/rundll32_control_rundll_world_writable_directory/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | -| [Rundll32 with no Command Line Arguments with Network](/endpoint/rundll32_with_no_command_line_arguments_with_network/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | -| [RunDLL Loading DLL By Ordinal](/endpoint/rundll_loading_dll_by_ordinal/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | -| [Suspicious Rundll32 dllregisterserver](/endpoint/suspicious_rundll32_dllregisterserver/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | -| [Suspicious Rundll32 StartW](/endpoint/suspicious_rundll32_startw/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | -| [Suspicious Rundll32 no Command Line Arguments](/endpoint/suspicious_rundll32_no_command_line_arguments/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Rundll32 Control RunDLL Hunt](/endpoint/rundll32_control_rundll_hunt/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| Hunting | +| [Rundll32 Control RunDLL World Writable Directory](/endpoint/rundll32_control_rundll_world_writable_directory/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Rundll32 with no Command Line Arguments with Network](/endpoint/rundll32_with_no_command_line_arguments_with_network/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [RunDLL Loading DLL By Ordinal](/endpoint/rundll_loading_dll_by_ordinal/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Suspicious Rundll32 dllregisterserver](/endpoint/suspicious_rundll32_dllregisterserver/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Suspicious Rundll32 StartW](/endpoint/suspicious_rundll32_startw/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Suspicious Rundll32 no Command Line Arguments](/endpoint/suspicious_rundll32_no_command_line_arguments/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | #### Reference diff --git a/docs/_stories/trickbot.md b/docs/_stories/trickbot.md index 2c54260829..87c8bc60c9 100644 --- a/docs/_stories/trickbot.md +++ b/docs/_stories/trickbot.md @@ -38,13 +38,13 @@ trickbot banking trojan campaigns targeting banks and other vertical sectors.Thi | [Attempt To Stop Security Service](/endpoint/attempt_to_stop_security_service/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP | | [Cobalt Strike Named Pipes](/endpoint/cobalt_strike_named_pipes/) | [Process Injection](/tags/#process-injection)| TTP | | [Executable File Written in Administrative SMB Share](/endpoint/executable_file_written_in_administrative_smb_share/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares)| TTP | -| [Mshta spawning Rundll32 OR Regsvr32 Process](/endpoint/mshta_spawning_rundll32_or_regsvr32_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | +| [Mshta spawning Rundll32 OR Regsvr32 Process](/endpoint/mshta_spawning_rundll32_or_regsvr32_process/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | | [Office Application Spawn rundll32 process](/endpoint/office_application_spawn_rundll32_process/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP | | [Office Document Executing Macro Code](/endpoint/office_document_executing_macro_code/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP | -| [Office Product Spawn CMD Process](/endpoint/office_product_spawn_cmd_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | +| [Office Product Spawn CMD Process](/endpoint/office_product_spawn_cmd_process/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | | [Powershell Remote Thread To Known Windows Process](/endpoint/powershell_remote_thread_to_known_windows_process/) | [Process Injection](/tags/#process-injection)| TTP | | [Schedule Task with Rundll32 Command Trigger](/endpoint/schedule_task_with_rundll32_command_trigger/) | [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP | -| [Suspicious Rundll32 StartW](/endpoint/suspicious_rundll32_startw/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Suspicious Rundll32 StartW](/endpoint/suspicious_rundll32_startw/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | | [Trickbot Named Pipe](/endpoint/trickbot_named_pipe/) | [Process Injection](/tags/#process-injection)| TTP | | [Wermgr Process Connecting To IP Check Web Services](/endpoint/wermgr_process_connecting_to_ip_check_web_services/) | [Gather Victim Network Information](/tags/#gather-victim-network-information), [IP Addresses](/tags/#ip-addresses)| TTP | | [Wermgr Process Create Executable File](/endpoint/wermgr_process_create_executable_file/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information)| TTP | diff --git a/docs/_stories/unusual_processes.md b/docs/_stories/unusual_processes.md index 94180289be..c7ec9418b2 100644 --- a/docs/_stories/unusual_processes.md +++ b/docs/_stories/unusual_processes.md @@ -40,12 +40,12 @@ In the event an unusual process is identified, it is imperative to better unders | [Attacker Tools On Endpoint](/endpoint/attacker_tools_on_endpoint/) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Masquerading](/tags/#masquerading), [OS Credential Dumping](/tags/#os-credential-dumping), [Active Scanning](/tags/#active-scanning)| TTP | | [Detect processes used for System Network Configuration Discovery](/endpoint/detect_processes_used_for_system_network_configuration_discovery/) | [System Network Configuration Discovery](/tags/#system-network-configuration-discovery)| TTP | | [Rundll32 Shimcache Flush](/endpoint/rundll32_shimcache_flush/) | [Modify Registry](/tags/#modify-registry)| TTP | -| [RunDLL Loading DLL By Ordinal](/endpoint/rundll_loading_dll_by_ordinal/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [RunDLL Loading DLL By Ordinal](/endpoint/rundll_loading_dll_by_ordinal/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | | [Suspicious Copy on System32](/endpoint/suspicious_copy_on_system32/) | [Rename System Utilities](/tags/#rename-system-utilities), [Masquerading](/tags/#masquerading)| TTP | | [System Processes Run From Unexpected Locations](/endpoint/system_processes_run_from_unexpected_locations/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities)| TTP | -| [Verclsid CLSID Execution](/endpoint/verclsid_clsid_execution/) | [Verclsid](/tags/#verclsid), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution)| Hunting | -| [Windows DotNet Binary in Non Standard Path](/endpoint/windows_dotnet_binary_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP | -| [Windows InstallUtil in Non Standard Path](/endpoint/windows_installutil_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP | +| [Verclsid CLSID Execution](/endpoint/verclsid_clsid_execution/) | [Verclsid](/tags/#verclsid), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution)| Hunting | +| [Windows DotNet Binary in Non Standard Path](/endpoint/windows_dotnet_binary_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP | +| [Windows InstallUtil in Non Standard Path](/endpoint/windows_installutil_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP | | [Windows NirSoft AdvancedRun](/endpoint/windows_nirsoft_advancedrun/) | [Tool](/tags/#tool)| TTP | | [Windows Remote Assistance Spawning Process](/endpoint/windows_remote_assistance_spawning_process/) | [Process Injection](/tags/#process-injection)| TTP | | [Wscript Or Cscript Suspicious Child Process](/endpoint/wscript_or_cscript_suspicious_child_process/) | [Process Injection](/tags/#process-injection), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation)| TTP | diff --git a/docs/_stories/whispergate.md b/docs/_stories/whispergate.md index 78a330f48c..73367f7ee0 100644 --- a/docs/_stories/whispergate.md +++ b/docs/_stories/whispergate.md @@ -48,9 +48,9 @@ WhisperGate/DEV-0586 is destructive malware operation found by MSTIC (Microsoft | [Suspicious Process DNS Query Known Abuse Web Services](/endpoint/suspicious_process_dns_query_known_abuse_web_services/) | [Visual Basic](/tags/#visual-basic), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| TTP | | [Suspicious Process File Path](/endpoint/suspicious_process_file_path/) | [Create or Modify System Process](/tags/#create-or-modify-system-process)| TTP | | [Suspicious Process With Discord DNS Query](/endpoint/suspicious_process_with_discord_dns_query/) | [Visual Basic](/tags/#visual-basic), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Anomaly | -| [Windows DotNet Binary in Non Standard Path](/endpoint/windows_dotnet_binary_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP | +| [Windows DotNet Binary in Non Standard Path](/endpoint/windows_dotnet_binary_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP | | [Windows High File Deletion Frequency](/endpoint/windows_high_file_deletion_frequency/) | [Data Destruction](/tags/#data-destruction)| Anomaly | -| [Windows InstallUtil in Non Standard Path](/endpoint/windows_installutil_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP | +| [Windows InstallUtil in Non Standard Path](/endpoint/windows_installutil_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP | | [Windows NirSoft AdvancedRun](/endpoint/windows_nirsoft_advancedrun/) | [Tool](/tags/#tool)| TTP | | [Windows NirSoft Utilities](/endpoint/windows_nirsoft_utilities/) | [Tool](/tags/#tool)| Hunting | | [Windows Raw Access To Master Boot Record Drive](/endpoint/windows_raw_access_to_master_boot_record_drive/) | [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe)| TTP | diff --git a/docs/_stories/windows_defense_evasion_tactics.md b/docs/_stories/windows_defense_evasion_tactics.md index d5073780ac..74d1b0f7be 100644 --- a/docs/_stories/windows_defense_evasion_tactics.md +++ b/docs/_stories/windows_defense_evasion_tactics.md @@ -77,7 +77,7 @@ Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adve | [Windows Hide Notification Features Through Registry](/endpoint/windows_hide_notification_features_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly | | [Windows Modify Show Compress Color And Info Tip Registry](/endpoint/windows_modify_show_compress_color_and_info_tip_registry/) | [Modify Registry](/tags/#modify-registry)| TTP | | [Windows Process With NamedPipe CommandLine](/endpoint/windows_process_with_namedpipe_commandline/) | [Process Injection](/tags/#process-injection)| Anomaly | -| [Windows Rasautou DLL Execution](/endpoint/windows_rasautou_dll_execution/) | [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Process Injection](/tags/#process-injection)| TTP | +| [Windows Rasautou DLL Execution](/endpoint/windows_rasautou_dll_execution/) | [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Process Injection](/tags/#process-injection)| TTP | | [WSReset UAC Bypass](/endpoint/wsreset_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP | #### Reference From 917d4e0dcab456f1f98c63ccb0e9fed913b9a877 Mon Sep 17 00:00:00 2001 From: d1vious Date: Fri, 27 May 2022 20:36:32 -0400 Subject: [PATCH 038/148] just removing bolding --- .../adapter/templates/doc_detections.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_detections.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_detections.j2 index b307a0c3ce..3f1a800ff2 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_detections.j2 +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_detections.j2 @@ -188,7 +188,7 @@ The SPL above uses the following Lookups: {% endif %} > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference {% if object.references %} From c5df761c4281046fce2f405b96bdd1d664282a84 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 30 May 2022 06:49:55 -0600 Subject: [PATCH 039/148] Falling for Follina --- .../windows_office_product_spawning_msdt.yml | 86 +++++++++++++++++++ 1 file changed, 86 insertions(+) create mode 100644 detections/endpoint/windows_office_product_spawning_msdt.yml diff --git a/detections/endpoint/windows_office_product_spawning_msdt.yml b/detections/endpoint/windows_office_product_spawning_msdt.yml new file mode 100644 index 0000000000..8c3c52d613 --- /dev/null +++ b/detections/endpoint/windows_office_product_spawning_msdt.yml @@ -0,0 +1,86 @@ +name: Windows Office Product Spawning MSDT +id: 127eba64-c981-40bf-8589-1830638864a7 +version: 1 +date: '2022-05-30' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies a Microsoft Office product spawning the Windows msdt.exe process. MSDT is a Diagnostics Troubleshooting Wizard native to Windows. This behavior is related to a recently identified sample utilizing protocol handlers to evade preventative controls, including if macros are disabled in the document. + During triage, review file modifications for html. In addition, parallel processes including PowerShell, CertUtil +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name + IN ("winword.exe","excel.exe","powerpnt.exe","outlook.exe","mspub.exe","visio.exe") Processes.process_name=msdt.exe + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `windows_office_product_spawning_msdt_filter`' +how_to_implement: how To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives should be limited, however filter as needed. +references: + - https://isc.sans.edu/diary/rss/28694 + - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e + - https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A + - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ + - https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection + - https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html +tags: + analytic_story: + - Spearphishing Attachments + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - UPDATE_DATASET_URL + impact: 100 + kill_chain_phases: + - Exploitation + message: Office parent process $parent_process_name$ has spawned a child + process $process_name$ on host $dest$. + mitre_attack_id: + - T1566 + - T1566.001 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 100 + security_domain: endpoint \ No newline at end of file From 0df4a18e94cd872f8b2e808d2a95e80fb26a8e6b Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 30 May 2022 06:59:14 -0600 Subject: [PATCH 040/148] Update windows_office_product_spawning_msdt.yml --- detections/endpoint/windows_office_product_spawning_msdt.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_office_product_spawning_msdt.yml b/detections/endpoint/windows_office_product_spawning_msdt.yml index 8c3c52d613..5ff2792f31 100644 --- a/detections/endpoint/windows_office_product_spawning_msdt.yml +++ b/detections/endpoint/windows_office_product_spawning_msdt.yml @@ -7,7 +7,7 @@ type: TTP datamodel: - Endpoint description: The following analytic identifies a Microsoft Office product spawning the Windows msdt.exe process. MSDT is a Diagnostics Troubleshooting Wizard native to Windows. This behavior is related to a recently identified sample utilizing protocol handlers to evade preventative controls, including if macros are disabled in the document. - During triage, review file modifications for html. In addition, parallel processes including PowerShell, CertUtil + During triage, review file modifications for html. In addition, parallel processes including PowerShell and CertUtil. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","outlook.exe","mspub.exe","visio.exe") Processes.process_name=msdt.exe From bc46202f260129955b6befb8fa686488216acc1c Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 30 May 2022 07:09:33 -0600 Subject: [PATCH 041/148] Create windows_execute_commands_with_msdt.yml --- .../windows_execute_commands_with_msdt.yml | 85 +++++++++++++++++++ 1 file changed, 85 insertions(+) create mode 100644 detections/endpoint/windows_execute_commands_with_msdt.yml diff --git a/detections/endpoint/windows_execute_commands_with_msdt.yml b/detections/endpoint/windows_execute_commands_with_msdt.yml new file mode 100644 index 0000000000..cdcd7274d2 --- /dev/null +++ b/detections/endpoint/windows_execute_commands_with_msdt.yml @@ -0,0 +1,85 @@ +name: Windows Execute Commands with MSDT +id: e1d5145f-38fe-42b9-a5d5-457796715f97 +version: 1 +date: '2022-05-30' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies a recently disclosed arbitraty command execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve a remote payload. + During triage, review file modifications for html. Identify parallel process execution that may be related, including an Office Product. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msdt.exe + Processes.process="*ms-msdt:/id*" Processes.process="*IT_BrowseForFile=*" Processes.process="*IT_RebrowseForFile=*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_execute_commands_with_msdt_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives may be present based on +references: + - https://isc.sans.edu/diary/rss/28694 + - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e + - https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A + - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ + - https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection + - https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html +tags: + analytic_story: + - UPDATE_STORY_NAME + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - UPDATE_DATASET_URL + impact: 100 + kill_chain_phases: + - Exploitation + message: A parent process $parent_process_name$ has spawned a child + process $process_name$ on host $dest$ possibly indicative of indirect command execution. + mitre_attack_id: + - T1202 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 100 + security_domain: endpoint \ No newline at end of file From 7153bf7b80993c988dfaa4bca7dd871ecc54804e Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 30 May 2022 15:44:52 +0200 Subject: [PATCH 042/148] path_traversal --- ...ipting_interpreter_path_traversal_exec.yml | 73 +++++++++++++++++++ ...g_interpreter_path_traversal_exec.test.yml | 13 ++++ 2 files changed, 86 insertions(+) create mode 100644 detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml create mode 100644 tests/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.test.yml diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml new file mode 100644 index 0000000000..692fdb3e74 --- /dev/null +++ b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml @@ -0,0 +1,73 @@ +name: Windows Command and Scripting Interpreter Path Traversal Exec +id: 58fcdeb1-728d-415d-b0d7-3ab18a275ec2 +version: 1 +date: '2022-05-30' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies path traversal commandline execution. This technique was seen in malicious document that execute malicious code + using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and commandline + that runs before and after this execution. This may help you to find possible downloaded malware or other lolbin execution. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*\/..\/..\/..\/..\/..\/..\/..\/..\/..\/*" by + Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process + Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash + | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_command_and_scripting_interpreter_path_traversal_exec_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product +known_false_positives: unknown +references: +- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ +tags: + analytic_story: + - Windows Defense Evasion Tactics + asset_type: UPDATE asset_type + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: UPDATE value between 1-100 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/path_traversal/sysmon.log + impact: 90 + kill_chain_phases: + - Exploitation + message: A parent process $parent_process_name$ has spawned a child $process_name$ with path traversal commandline $process$ in $dest$ + mitre_attack_id: + - T1059 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 100 + security_domain: endpoint diff --git a/tests/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.test.yml b/tests/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.test.yml new file mode 100644 index 0000000000..016e1718a1 --- /dev/null +++ b/tests/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.test.yml @@ -0,0 +1,13 @@ +name: Windows Command and Scripting Interpreter Path Traversal Exec Unit Test +tests: +- name: Windows Command and Scripting Interpreter Path Traversal Exec + file: endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/path_traversal/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From d0431af517ae320d6bff7c72539be7307611b3e3 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 30 May 2022 15:51:13 +0200 Subject: [PATCH 043/148] path_traversal --- ..._command_and_scripting_interpreter_path_traversal_exec.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml index 692fdb3e74..6780304d6d 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml @@ -33,7 +33,7 @@ tags: - CIS 3 - CIS 5 - CIS 16 - confidence: UPDATE value between 1-100 + confidence: 100 context: - Source:Endpoint - Stage:Defense Evasion @@ -69,5 +69,5 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 100 + risk_score: 90 security_domain: endpoint From f16de553cc6a57c78d6cd6b415d6bcb86bc49be4 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 31 May 2022 11:04:09 +0200 Subject: [PATCH 044/148] fix issue 2215 --- .github/workflows/build-and-validate.yml | 5 ++ bin/reporting/detection_count.svg | 2 +- docs/mitre-map/coverage.json | 73 +++++++++++------------- 3 files changed, 40 insertions(+), 40 deletions(-) diff --git a/.github/workflows/build-and-validate.yml b/.github/workflows/build-and-validate.yml index cb6f09b7c0..f6c2cb2019 100644 --- a/.github/workflows/build-and-validate.yml +++ b/.github/workflows/build-and-validate.yml @@ -426,6 +426,11 @@ jobs: source venv/bin/activate python3 contentctl.py -p . docgen -o docs + - name: Run reporting + run: | + source venv/bin/activate + python3 contentctl.py -p . reporting + - name: Update github with new docs and package bits run: | rm -rf dist diff --git a/bin/reporting/detection_count.svg b/bin/reporting/detection_count.svg index bf679ca544..48b1d9603b 100644 --- a/bin/reporting/detection_count.svg +++ b/bin/reporting/detection_count.svg @@ -13,6 +13,6 @@ detections - 790 + 806 \ No newline at end of file diff --git a/docs/mitre-map/coverage.json b/docs/mitre-map/coverage.json index 4b9b651c3f..39f30b0ea8 100644 --- a/docs/mitre-map/coverage.json +++ b/docs/mitre-map/coverage.json @@ -291,13 +291,13 @@ }, { "techniqueID": "T1087.002", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml" + "score": 19, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_root_domain_linked_policies_discovery.yml" }, { "techniqueID": "T1087", - "score": 24, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml" + "score": 26, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/adsisearcher_account_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_azurehound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_file_modifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_sharphound_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_dsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_net_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/domain_account_discovery_with_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/enumerate_users_local_group_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_aduser_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_domainuser_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_net.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/local_account_discovery_with_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_linked_policies_in_adsi_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_root_domain_linked_policies_discovery.yml" }, { "techniqueID": "T1547.014", @@ -341,8 +341,8 @@ }, { "techniqueID": "T1059", - "score": 37, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_carry_out_string_command_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/macos_lolbin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_writing_dynamicwrapperx.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_with_discord_dns_query.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/vbscript_execution_using_wscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_module_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml" + "score": 38, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_carry_out_string_command_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/macos_lolbin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_writing_dynamicwrapperx.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_with_discord_dns_query.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/vbscript_execution_using_wscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_module_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml" }, { "techniqueID": "T1105", @@ -396,28 +396,28 @@ }, { "techniqueID": "T1033", - "score": 8, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml" + "score": 7, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/check_elevated_cmd_using_whoami.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getcurrent_user_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_query.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/system_user_discovery_with_whoami.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml" }, { "techniqueID": "T1070.004", - "score": 9, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_cron_jobs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_init_daemon_script.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_ssh_key.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_ssl_certificate.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdelete_application_execution.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_cron_jobs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_init_daemon_script.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_ssl_certificate.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdelete_application_execution.yml" }, { "techniqueID": "T1070", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_cron_jobs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_init_daemon_script.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_ssh_key.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_ssl_certificate.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdelete_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml" + "score": 18, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_logs_using_wevtutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fsutil_zeroing_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_cron_jobs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_init_daemon_script.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_ssl_certificate.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_deleting_its_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdelete_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_event_log_service_behavior.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/usn_journal_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_log_cleared.yml" }, { "techniqueID": "T1543", - "score": 14, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_service_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_service_creation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/randomly_generated_windows_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_plistbuddy_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_plistbuddy_usage_via_osquery.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_ransomware_known_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_service_create_kernel_mode_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_service_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_service_creation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/randomly_generated_windows_service_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_plistbuddy_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_plistbuddy_usage_via_osquery.yml" }, { "techniqueID": "T1543.003", - "score": 12, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_krbrelayup_service_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_service_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_service_creation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/randomly_generated_windows_service_name.yml" + "score": 13, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sc_exe_manipulating_windows_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_driver_loaded_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_krbrelayup_service_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_service_create_kernel_mode_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_service_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_service_creation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/xmrig_driver_loaded.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/randomly_generated_windows_service_name.yml" }, { "techniqueID": "T1059.007", @@ -436,8 +436,8 @@ }, { "techniqueID": "T1485", - "score": 14, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_dd_file_overwrite.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_cron_jobs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_init_daemon_script.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_ssh_key.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_ssl_certificate.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdelete_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_memory_crash_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_file_without_extension_in_critical_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_high_file_deletion_frequency.yml" + "score": 17, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_account_manipulation_of_ssh_config_and_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_dd_file_overwrite.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deleting_critical_directory_using_rm_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_cron_jobs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_init_daemon_script.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_deletion_of_ssl_certificate.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_high_frequency_of_file_deletion_in_boot_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_shred_overwrite_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdelete_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_memory_crash_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_file_without_extension_in_critical_folder.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_high_file_deletion_frequency.yml" }, { "techniqueID": "T1218.002", @@ -521,8 +521,8 @@ }, { "techniqueID": "T1190", - "score": 22, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hunting_for_log4shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/java_class_file_download_by_java_user_agent.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/java_writing_jsp_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_java_spawning_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_abuse_via_ssrf.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_java_spawning_shells.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winrm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_zerologon_via_zeek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/detect_f5_tmui_rce_cve_2020_5902.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/sql_injection_with_long_urls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/log4shell_jndi_payload_injection_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/spring4shell_payload_url_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_jsp_request_via_url.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_spring4shell_http_request_class_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_spring_cloud_function_functionrouter.yml" + "score": 25, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hunting_for_log4shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/java_class_file_download_by_java_user_agent.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/java_writing_jsp_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_java_spawning_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_abuse_via_ssrf.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_java_spawning_shells.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winrm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_zerologon_via_zeek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/detect_f5_tmui_rce_cve_2020_5902.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/sql_injection_with_long_urls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/log4shell_jndi_payload_injection_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/spring4shell_payload_url_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/vmware_server_side_template_injection_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_jsp_request_via_url.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_spring4shell_http_request_class_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_spring_cloud_function_functionrouter.yml" }, { "techniqueID": "T1218.001", @@ -631,8 +631,8 @@ }, { "techniqueID": "T1489", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_stop_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml" }, { "techniqueID": "T1222", @@ -696,18 +696,18 @@ }, { "techniqueID": "T1053.003", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_adding_crontab_using_list_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml" }, { "techniqueID": "T1053", - "score": 24, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/randomly_generated_scheduled_task_name.yml" + "score": 26, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_files_in_known_crontab_directories.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_adding_crontab_using_list_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_allow_config_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_edit_cron_table_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_file_created_in_systemd_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_restarted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_service_started_or_enabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_http_command_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_run_task_on_demand.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/svchost_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_hidden_schedule_task_settings.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_schtasks_create_run_as_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/randomly_generated_scheduled_task_name.yml" }, { - "techniqueID": "T1053.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml" + "techniqueID": "T1053.002", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_at_application_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml" }, { "techniqueID": "T1222.002", @@ -751,8 +751,8 @@ }, { "techniqueID": "T1068", - "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_pkexec_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_baron_samedit_cve_2021_3156.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml" + "score": 10, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_pkexec_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/spoolsv_suspicious_process_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_drivers_loaded_by_signature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_service_create_kernel_mode_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_system_file_on_disk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/child_processes_of_spoolsv_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_baron_samedit_cve_2021_3156.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/first_time_seen_child_process_of_zoom.yml" }, { "techniqueID": "T1098.004", @@ -790,7 +790,7 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/macos_lolbin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_linux_discovery_commands.yml" }, { - "techniqueID": "T1547.011", + "techniqueID": "T1647", "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/macos_plutil.yml" }, @@ -929,11 +929,6 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/runas_execution_in_commandline.yml" }, - { - "techniqueID": "T1053.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml" - }, { "techniqueID": "T1546.002", "score": 1, @@ -981,8 +976,8 @@ }, { "techniqueID": "T1014", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_drivers_loaded_by_signature.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_driver_load_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_drivers_loaded_by_signature.yml" }, { "techniqueID": "T1202", From 3aa7679d7bc0ee37be0351e600e5dbaf9c070cdd Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 31 May 2022 15:08:39 +0200 Subject: [PATCH 045/148] Update windows_command_and_scripting_interpreter_path_traversal_exec.yml --- ...ows_command_and_scripting_interpreter_path_traversal_exec.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml index 6780304d6d..1d67eb41ca 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml @@ -28,6 +28,7 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 asset_type: UPDATE asset_type cis20: - CIS 3 From 87a9aea4dd2e978ffb8652bc80fa14bfc84e3fe5 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 31 May 2022 07:16:05 -0600 Subject: [PATCH 046/148] Complete Follina --- ..._execute_arbitrary_commands_with_msdt.yml} | 10 +++++--- .../windows_office_product_spawning_msdt.yml | 5 +++- ...stic_tool_vulnerability_cve_2022_30190.yml | 25 +++++++++++++++++++ stories/windows_drivers.yml | 1 - ...cute_arbitrary_commands_with_msdt.test.yml | 13 ++++++++++ ...dows_office_product_spawning_msdt.test.yml | 13 ++++++++++ 6 files changed, 61 insertions(+), 6 deletions(-) rename detections/endpoint/{windows_execute_commands_with_msdt.yml => windows_execute_arbitrary_commands_with_msdt.yml} (91%) create mode 100644 stories/microsoft_support_diagnostic_tool_vulnerability_cve_2022_30190.yml create mode 100644 tests/endpoint/windows_execute_arbitrary_commands_with_msdt.test.yml create mode 100644 tests/endpoint/windows_office_product_spawning_msdt.test.yml diff --git a/detections/endpoint/windows_execute_commands_with_msdt.yml b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml similarity index 91% rename from detections/endpoint/windows_execute_commands_with_msdt.yml rename to detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml index cdcd7274d2..8b1887f1b1 100644 --- a/detections/endpoint/windows_execute_commands_with_msdt.yml +++ b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml @@ -1,8 +1,8 @@ -name: Windows Execute Commands with MSDT +name: Windows Execute Arbitrary Commands with MSDT id: e1d5145f-38fe-42b9-a5d5-457796715f97 version: 1 date: '2022-05-30' -author: Michael Haag, Splunk +author: Michael Haag, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -14,7 +14,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_execute_commands_with_msdt_filter`' + | `security_content_ctime(lastTime)` | `windows_execute_arbitrary_commands_with_msdt_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: False positives may be present based on references: @@ -26,8 +26,10 @@ references: - https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html tags: analytic_story: - - UPDATE_STORY_NAME + - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 asset_type: Endpoint + cve: + - CVE-2022-30190 cis20: - CIS 3 - CIS 5 diff --git a/detections/endpoint/windows_office_product_spawning_msdt.yml b/detections/endpoint/windows_office_product_spawning_msdt.yml index 5ff2792f31..8333e8887a 100644 --- a/detections/endpoint/windows_office_product_spawning_msdt.yml +++ b/detections/endpoint/windows_office_product_spawning_msdt.yml @@ -2,7 +2,7 @@ name: Windows Office Product Spawning MSDT id: 127eba64-c981-40bf-8589-1830638864a7 version: 1 date: '2022-05-30' -author: Michael Haag, Splunk +author: Michael Haag, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -27,7 +27,10 @@ references: tags: analytic_story: - Spearphishing Attachments + - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 asset_type: Endpoint + cve: + - CVE-2022-30190 cis20: - CIS 3 - CIS 5 diff --git a/stories/microsoft_support_diagnostic_tool_vulnerability_cve_2022_30190.yml b/stories/microsoft_support_diagnostic_tool_vulnerability_cve_2022_30190.yml new file mode 100644 index 0000000000..705256576d --- /dev/null +++ b/stories/microsoft_support_diagnostic_tool_vulnerability_cve_2022_30190.yml @@ -0,0 +1,25 @@ +name: Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 +id: 2a60a99e-c93a-4036-af70-768fac838019 +version: 1 +date: '2022-05-31' +author: 'Michael Haag, Teoderick Contreras, Splunk' +description: On Monday May 30, 2022, Microsoft issued CVE-2022-30190 regarding the Microsoft Support Diagnostic Tool (MSDT) in Windows vulnerability. +narrative: + A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user''s rights. +references: + - https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/ + - https://isc.sans.edu/diary/rss/28694 + - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e + - https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A + - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ + - https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection + - https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html +tags: + analytic_story: Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection diff --git a/stories/windows_drivers.yml b/stories/windows_drivers.yml index 65ea415805..598d0a684c 100644 --- a/stories/windows_drivers.yml +++ b/stories/windows_drivers.yml @@ -16,7 +16,6 @@ references: - https://www.welivesecurity.com/2022/01/11/signed-kernel-drivers-unguarded-gateway-windows-core/ tags: analytic_story: Windows Drivers - category: [] product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/tests/endpoint/windows_execute_arbitrary_commands_with_msdt.test.yml b/tests/endpoint/windows_execute_arbitrary_commands_with_msdt.test.yml new file mode 100644 index 0000000000..b3f15312c6 --- /dev/null +++ b/tests/endpoint/windows_execute_arbitrary_commands_with_msdt.test.yml @@ -0,0 +1,13 @@ +name: Windows Execute Arbitrary Commands with MSDT Unit Test +tests: +- name: Windows Execute Arbitrary Commands with MSDT + file: endpoint/windows_execute_arbitrary_commands_with_msdt.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: msdt.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_office_product_spawning_msdt.test.yml b/tests/endpoint/windows_office_product_spawning_msdt.test.yml new file mode 100644 index 0000000000..867bdaf783 --- /dev/null +++ b/tests/endpoint/windows_office_product_spawning_msdt.test.yml @@ -0,0 +1,13 @@ +name: Windows Office Product Spawning MSDT Unit Test +tests: +- name: Windows Office Product Spawning MSDT + file: endpoint/windows_office_product_spawning_msdt.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: msdt.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From 3a1ad123bd8d1bc79a9da8977f1343f1ba3f740c Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 31 May 2022 07:23:11 -0600 Subject: [PATCH 047/148] url --- .../endpoint/windows_execute_arbitrary_commands_with_msdt.yml | 4 ++-- detections/endpoint/windows_office_product_spawning_msdt.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml index 8b1887f1b1..439f0d1a04 100644 --- a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml +++ b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml @@ -39,7 +39,7 @@ tags: - Source:Endpoint - Stage:Defense Evasion dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log impact: 100 kill_chain_phases: - Exploitation @@ -58,7 +58,7 @@ tags: type: Hostname role: - Victim - - name: parent_process_name + - name: Process type: Parent Process role: - Parent Process diff --git a/detections/endpoint/windows_office_product_spawning_msdt.yml b/detections/endpoint/windows_office_product_spawning_msdt.yml index 8333e8887a..9098c9e3f1 100644 --- a/detections/endpoint/windows_office_product_spawning_msdt.yml +++ b/detections/endpoint/windows_office_product_spawning_msdt.yml @@ -40,7 +40,7 @@ tags: - Source:Endpoint - Stage:Defense Evasion dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log impact: 100 kill_chain_phases: - Exploitation @@ -60,7 +60,7 @@ tags: type: Hostname role: - Victim - - name: parent_process_name + - name: Process type: Parent Process role: - Parent Process From 2af655958335400e04ea19dbc3de69013c3bbcb9 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 31 May 2022 07:32:49 -0600 Subject: [PATCH 048/148] computer hard --- .../windows_execute_arbitrary_commands_with_msdt.yml | 6 +++--- .../endpoint/windows_office_product_spawning_msdt.yml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml index 439f0d1a04..8edf5cb667 100644 --- a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml +++ b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml @@ -54,12 +54,12 @@ tags: type: User role: - Victim - - name: Computer + - name: dest type: Hostname role: - Victim - - name: Process - type: Parent Process + - name: parent_process_name + type: Process role: - Parent Process - name: process_name diff --git a/detections/endpoint/windows_office_product_spawning_msdt.yml b/detections/endpoint/windows_office_product_spawning_msdt.yml index 9098c9e3f1..fe9ec16b7a 100644 --- a/detections/endpoint/windows_office_product_spawning_msdt.yml +++ b/detections/endpoint/windows_office_product_spawning_msdt.yml @@ -56,12 +56,12 @@ tags: type: User role: - Victim - - name: Computer + - name: dest type: Hostname role: - Victim - - name: Process - type: Parent Process + - name: parent_process_name + type: Process role: - Parent Process - name: process_name From 5d3b3028889abd922784c3d5e74042777f933cc4 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 31 May 2022 07:43:57 -0600 Subject: [PATCH 049/148] Update windows_drivers.yml --- stories/windows_drivers.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/stories/windows_drivers.yml b/stories/windows_drivers.yml index 598d0a684c..ac2e14ea17 100644 --- a/stories/windows_drivers.yml +++ b/stories/windows_drivers.yml @@ -16,6 +16,8 @@ references: - https://www.welivesecurity.com/2022/01/11/signed-kernel-drivers-unguarded-gateway-windows-core/ tags: analytic_story: Windows Drivers + category: + - Adversary Tactics product: - Splunk Enterprise - Splunk Enterprise Security From baac782e945056aec3253b4b85773d2cc3d5d65a Mon Sep 17 00:00:00 2001 From: d1vious Date: Tue, 31 May 2022 10:14:24 -0400 Subject: [PATCH 050/148] updating tests --- ...-07-21-detect_new_user_aws_console_login.md | 14 ++++++++++---- ...redential_dump_from_registry_via_reg_exe.md | 18 ++++++++++++++---- .../tests/adapter/test_obj_to_md_adapter.py | 2 +- 3 files changed, 25 insertions(+), 9 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2020-07-21-detect_new_user_aws_console_login.md b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2020-07-21-detect_new_user_aws_console_login.md index daf6babc29..5a3a944eb6 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2020-07-21-detect_new_user_aws_console_login.md +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2020-07-21-detect_new_user_aws_console_login.md @@ -26,7 +26,7 @@ tags: This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour. Deprecated now this search is updated to use the Authentication datamodel. -- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Last Updated**: 2020-07-21 @@ -96,7 +96,7 @@ This search looks for AWS CloudTrail events wherein a console login event by a u -#### Search +#### Search ``` `cloudtrail` eventName=ConsoleLogin @@ -113,8 +113,11 @@ This search looks for AWS CloudTrail events wherein a console login event by a u #### Macros The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that **detect_new_user_aws_console_login_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_new_user_aws_console_login_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,9 +141,12 @@ When a legitimate new user logins for the first time, this activity will be dete | Risk Score | Impact | Confidence | Message | | ----------- | ----------- |--------------|--------------| -| 90.0 | 90 | 100 | tbd | +| 25.0 | 50 | 50 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md index 6d22e9f464..0ce7794c62 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md @@ -4,7 +4,7 @@ excerpt: "Security Account Manager , OS Credential Dumping " categories: - - Detection + - Endpoint last_modified_at: 2021-09-16 toc: true toc_label: "" @@ -100,7 +100,7 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th -#### Search +#### Search ``` @@ -113,8 +113,13 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th #### Macros The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) -Note that **attempted_credential_dump_from_registry_via_reg_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **attempted_credential_dump_from_registry_via_reg_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,6 +145,8 @@ None identified. #### Associated Analytic story * [Credential Dumping](/stories/credential_dumping) * [DarkSide Ransomware](/stories/darkside_ransomware) +* [Windows Registry Abuse](/stories/windows_registry_abuse) +* [Industroyer2](/stories/industroyer2) @@ -151,6 +158,9 @@ None identified. | 90.0 | 90 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets) @@ -166,4 +176,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith -[*source*](https://github.com/splunk/security_content/tree/develop/detections/detection/attempted_credential_dump_from_registry_via_reg_exe.yml) \| *version*: **6** \ No newline at end of file +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml) \| *version*: **6** \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_md_adapter.py b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_md_adapter.py index 00e84957e0..a043acb019 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_md_adapter.py +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_md_adapter.py @@ -101,4 +101,4 @@ def test_md_writer(): for file in files_to_compare: path = os.path.join(os.path.dirname(__file__), 'obj_to_md_data', file) path_ref = os.path.join(os.path.dirname(__file__), 'obj_to_md_data_ref', file) - assert filecmp.cmp(path, path_ref, shallow=False) \ No newline at end of file + assert filecmp.cmp(path, path_ref, shallow=False) From ce00e2414e8f88174c52a57a71640ff3fd39691a Mon Sep 17 00:00:00 2001 From: d1vious Date: Tue, 31 May 2022 11:11:40 -0400 Subject: [PATCH 051/148] fixing testing redux --- .../adapter/data/lookups/mitre_enrichment.csv | 332 +++++++++--------- .../obj_to_json_adapter_data/detections.json | 2 +- .../obj_to_json_adapter_data/stories.json | 2 +- ...07-21-detect_new_user_aws_console_login.md | 8 +- ...edential_dump_from_registry_via_reg_exe.md | 8 +- ...07-21-detect_new_user_aws_console_login.md | 8 +- ...edential_dump_from_registry_via_reg_exe.md | 12 +- ...spectre_and_meltdown_vulnerable_systems.md | 2 +- ...12-detect_new_login_attempts_to_routers.md | 2 +- ...od_without_successful_netbackup_backups.md | 4 +- .../2017-09-12-identify_new_user_accounts.md | 2 +- ...17-09-12-unsuccessful_netbackup_backups.md | 4 +- ...tect_unauthorized_assets_by_mac_address.md | 2 +- ...9-15-no_windows_updates_in_a_time_frame.md | 2 +- ...9-email_attachments_with_lots_of_spaces.md | 2 +- .../2017-09-19-open_redirect_in_splunk_web.md | 2 +- ...7-09-20-large_volume_of_dns_any_queries.md | 2 +- ...s_scanning_for_vulnerable_jboss_servers.md | 2 +- ...cious_requests_to_exploit_jboss_servers.md | 2 +- .../2017-09-23-monitor_dns_for_brand_abuse.md | 4 +- ...-23-monitor_web_traffic_for_brand_abuse.md | 4 +- ...0-13-unusually_long_content-type_length.md | 2 +- .../2017-11-27-detect_usb_device_insertion.md | 2 +- ...018-01-05-monitor_email_for_brand_abuse.md | 2 +- ...nce_started_in_previously_unseen_region.md | 4 +- ...ance_started_with_previously_unseen_ami.md | 4 +- ...rovisioning_from_previously_unseen_city.md | 2 +- ...isioning_from_previously_unseen_country.md | 2 +- ...oning_from_previously_unseen_ip_address.md | 2 +- ...visioning_from_previously_unseen_region.md | 2 +- ...16-detect_new_api_calls_from_user_roles.md | 4 +- ...detect_spike_in_security_group_activity.md | 2 +- ..._blocked_outbound_traffic_from_your_aws.md | 2 +- ...ect_api_activity_from_users_without_mfa.md | 4 +- ...21-detect_spike_in_network_acl_activity.md | 2 +- ...6-01-detect_large_outbound_icmp_packets.md | 2 +- ...plunk_enterprise_information_disclosure.md | 2 +- ...18-06-28-detect_s3_access_from_a_new_ip.md | 4 +- ...18-10-08-web_fraud_-_account_harvesting.md | 2 +- ...8-web_fraud_-_anomalous_user_clickspeed.md | 2 +- ...raud_-_password_sharing_across_accounts.md | 2 +- ...ce_created_with_previously_unseen_image.md | 2 +- ...-10-23-wmi_permanent_event_subscription.md | 2 +- ...-10-23-wmi_temporary_event_subscription.md | 2 +- ...8-11-02-windows_hosts_file_modification.md | 2 +- ...1-27-detect_spike_in_s3_bucket_deletion.md | 2 +- .../2018-12-03-remote_wmi_command_attempt.md | 4 +- .../_posts/2018-12-03-usn_journal_deletion.md | 2 +- .../2018-12-06-suspicious_java_classes.md | 2 +- .../2018-12-14-file_with_samsam_extension.md | 2 +- .../2018-12-14-samsam_test_file_write.md | 2 +- ...01-25-processes_tapping_keyboard_events.md | 2 +- ...01-29-osquery_pack_-_coldroot_detection.md | 2 +- ...ikatz_via_powershell_and_eventcode_4703.md | 2 +- ...ide_files_directories_via_registry_keys.md | 2 +- ..._servers_executing_suspicious_processes.md | 2 +- .../2019-04-25-suspicious_file_write.md | 2 +- ...5-08-unusually_long_command_line_-_mltk.md | 2 +- ...9-10-11-prohibited_software_on_endpoint.md | 4 +- ...credential_dumping_through_lsass_access.md | 2 +- ...-03-detect_mimikatz_using_loaded_images.md | 2 +- ...6-access_lsass_memory_for_dump_creation.md | 2 +- ...9-12-06-create_remote_thread_into_lsass.md | 2 +- ...19-12-06-unsigned_image_loaded_by_lsass.md | 2 +- .../2019-12-10-creation_of_shadow_copy.md | 2 +- ...-01-22-dns_query_length_outliers_-_mltk.md | 2 +- ...0-01-28-auto_admin_logon_registry_entry.md | 2 +- ...onitor_registry_keys_for_print_monitors.md | 2 +- ...gistry_keys_for_creating_shim_databases.md | 2 +- docs/_posts/2020-01-28-sdclt_uac_bypass.md | 2 +- .../2020-01-28-silentcleanup_uac_bypass.md | 2 +- docs/_posts/2020-01-28-wsreset_uac_bypass.md | 2 +- ...-03-creation_of_lsass_dump_with_taskmgr.md | 2 +- ...ed_with_previously_unseen_instance_type.md | 4 +- ...20-02-07-macos_-_re-opened_applications.md | 2 +- .../2020-02-20-gcp_gcr_container_uploaded.md | 2 +- ...02-20-new_container_uploaded_to_aws_ecr.md | 2 +- .../2020-02-21-dump_lsass_via_comsvcs_dll.md | 2 +- ...03-02-remote_registry_key_modifications.md | 2 +- ...20-03-16-child_processes_of_spoolsv_exe.md | 2 +- .../2020-03-16-detect_rare_executables.md | 4 +- .../2020-03-16-process_execution_via_wmi.md | 2 +- .../2020-03-16-script_execution_via_wmi.md | 2 +- .../_posts/2020-03-16-spike_in_file_writes.md | 2 +- ...n_eks_kubernetes_cluster_scan_detection.md | 2 +- ...mazon_eks_kubernetes_pod_scan_detection.md | 2 +- ...5-gcp_kubernetes_cluster_scan_detection.md | 2 +- ...05-19-kubernetes_azure_scan_fingerprint.md | 2 +- ...0-first_time_seen_child_process_of_zoom.md | 4 +- ...es_azure_detect_sensitive_object_access.md | 2 +- ...etes_azure_detect_sensitive_role_access.md | 2 +- ...rvice_accounts_forbidden_failure_access.md | 2 +- ...0-kubernetes_azure_pod_scan_fingerprint.md | 2 +- ...ctive_service_accounts_by_pod_namespace.md | 2 +- ...re_detect_rbac_authorization_by_account.md | 2 +- ...s_azure_detect_suspicious_kubectl_calls.md | 2 +- ...activity_from_previously_unseen_account.md | 2 +- ...ernetes_cluster_sensitive_object_access.md | 2 +- ...ect_most_active_service_accounts_by_pod.md | 2 +- ...ws_detect_rbac_authorization_by_account.md | 2 +- ...rnetes_aws_detect_sensitive_role_access.md | 2 +- ...rvice_accounts_forbidden_failure_access.md | 2 +- ...tes_aws_detect_suspicious_kubectl_calls.md | 2 +- ...rvice_accounts_forbidden_failure_access.md | 2 +- ...interception_by_creation_of_program_exe.md | 2 +- ...2020-07-06-short_lived_windows_accounts.md | 2 +- .../2020-07-06-windows_event_log_cleared.md | 6 +- ...20-07-07-remote_desktop_network_traffic.md | 2 +- ...20-07-08-detect_new_local_admin_account.md | 2 +- ...ect_most_active_service_accounts_by_pod.md | 2 +- ...p_detect_rbac_authorizations_by_account.md | 2 +- ...etes_gcp_detect_sensitive_object_access.md | 2 +- ...rnetes_gcp_detect_sensitive_role_access.md | 2 +- ...tes_gcp_detect_suspicious_kubectl_calls.md | 2 +- ...p_kubernetes_cluster_pod_scan_detection.md | 2 +- ...lly_high_aws_instances_launched_by_user.md | 2 +- ...h_aws_instances_launched_by_user_-_mltk.md | 2 +- ...y_high_aws_instances_terminated_by_user.md | 2 +- ...aws_instances_terminated_by_user_-_mltk.md | 2 +- ...-07-21-attempt_to_stop_security_service.md | 2 +- ...ents_connecting_to_multiple_dns_servers.md | 2 +- ...api_activities_from_unapproved_accounts.md | 4 +- ..._to_phishing_sites_leveraging_evilginx2.md | 12 +- ...-detect_excessive_user_account_lockouts.md | 2 +- ...-21-detect_long_dns_txt_record_response.md | 2 +- ...07-21-detect_new_user_aws_console_login.md | 4 +- .../2020-07-21-detect_outbound_smb_traffic.md | 2 +- ...1-detect_outlook_exe_writing_a_zip_file.md | 2 +- ...-07-21-detect_spike_in_aws_api_activity.md | 2 +- ...f_cmd_exe_to_launch_script_interpreters.md | 2 +- ...web_traffic_to_dynamic_domain_providers.md | 4 +- ...-21-detection_of_tools_built_by_nirsoft.md | 2 +- ...ts_resolved_by_unauthorized_dns_servers.md | 2 +- docs/_posts/2020-07-21-dns_record_changed.md | 2 +- ...ce_modified_with_previously_unseen_user.md | 4 +- ...nce_started_with_previously_unseen_user.md | 4 +- ...ritten_outside_of_the_outlook_directory.md | 2 +- ...rs_sending_high_volume_traffic_to_hosts.md | 2 +- .../2020-07-21-excessive_dns_failures.md | 2 +- ...1-first_time_seen_command_line_argument.md | 2 +- ...first_time_seen_running_windows_service.md | 4 +- ...g_files_and_directories_with_attrib_exe.md | 2 +- ...me_of_network_traffic_from_email_server.md | 2 +- ...shell_process_-_execution_policy_bypass.md | 2 +- ...th_invalid_credentials_from_the_same_ip.md | 2 +- .../2020-07-21-okta_account_lockout_events.md | 2 +- .../2020-07-21-okta_failed_sso_attempts.md | 2 +- ...1-okta_user_logins_from_multiple_cities.md | 2 +- ...7-21-overwriting_accessibility_binaries.md | 2 +- ...7-21-prohibited_network_traffic_allowed.md | 2 +- .../2020-07-21-protocol_or_port_mismatch.md | 2 +- ...07-21-remote_desktop_network_bruteforce.md | 2 +- ...emote_desktop_process_running_on_system.md | 2 +- ...21-sc_exe_manipulating_windows_services.md | 2 +- ...uled_tasks_used_in_badrabbit_ransomware.md | 2 +- docs/_posts/2020-07-22-smb_traffic_spike.md | 2 +- .../2020-07-22-smb_traffic_spike_-_mltk.md | 2 +- ...suspicious_changes_to_file_associations.md | 2 +- ...20-07-22-suspicious_email_-_uba_anomaly.md | 2 +- ...-suspicious_email_attachment_extensions.md | 2 +- .../2020-07-22-suspicious_reg_exe_process.md | 2 +- ...ous_writes_to_system_volume_information.md | 2 +- ...uspicious_writes_to_windows_recycle_bin.md | 2 +- docs/_posts/2020-07-22-tor_traffic.md | 2 +- ...20-07-22-uncommon_processes_on_endpoint.md | 4 +- .../2020-07-22-unload_sysmon_filter_driver.md | 2 +- ...-07-27-aws_detect_attach_to_role_policy.md | 2 +- ...07-27-aws_detect_permanent_key_creation.md | 2 +- .../2020-07-27-aws_detect_role_creation.md | 2 +- ...-07-27-aws_detect_sts_assume_role_abuse.md | 2 +- ...-aws_detect_sts_get_session_token_abuse.md | 2 +- ...ct_windows_dns_sigred_via_splunk_stream.md | 2 +- ...7-28-detect_windows_dns_sigred_via_zeek.md | 2 +- ...ance_modified_by_previously_unseen_user.md | 2 +- ...-08-02-detect_f5_tmui_rce_cve-2020-5902.md | 2 +- ...-05-detect_new_open_gcp_storage_buckets.md | 2 +- ...detect_gcp_storage_access_from_a_new_ip.md | 2 +- .../_posts/2020-08-11-detect_arp_poisoning.md | 2 +- .../2020-08-11-detect_rogue_dhcp_server.md | 2 +- ...ivity_from_previously_unseen_ip_address.md | 2 +- ..._activity_from_previously_unseen_region.md | 2 +- ...igh_number_of_cloud_instances_destroyed.md | 2 +- ...high_number_of_cloud_instances_launched.md | 2 +- ...2020-09-01-gcp_detect_oauth_token_abuse.md | 2 +- ...nce_created_in_previously_unused_region.md | 2 +- ...calls_from_previously_unseen_user_roles.md | 2 +- ...umber_of_cloud_infrastructure_api_calls.md | 2 +- ...umber_of_cloud_security_group_api_calls.md | 2 +- ...oud_network_access_control_list_deleted.md | 4 +- ...ed_with_previously_unseen_instance_type.md | 2 +- .../2020-09-15-detect_zerologon_via_zeek.md | 2 +- ..._or_delete_windows_shares_using_net_exe.md | 2 +- ...computer_changed_with_anonymous_account.md | 2 +- ...aws_console_login_by_user_from_new_city.md | 2 +- ..._console_login_by_user_from_new_country.md | 2 +- ...s_console_login_by_user_from_new_region.md | 2 +- ...2020-10-08-gcp_detect_gcploit_framework.md | 2 +- ...ng_activity_from_previously_unseen_city.md | 2 +- ...activity_from_previously_unseen_country.md | 2 +- ...ccounts_with_high_risk_roles_by_project.md | 2 +- ...isk_permissions_by_resource_and_account.md | 2 +- ...tivity_related_to_pass_the_hash_attacks.md | 2 +- ...20-10-21-detect_snicat_sni_exfiltration.md | 2 +- ...ect_ipv6_network_infrastructure_threats.md | 2 +- ...20-10-28-detect_port_security_violation.md | 2 +- ...ect_software_download_to_network_device.md | 2 +- .../2020-10-28-detect_traffic_mirroring.md | 2 +- .../2020-11-06-ryuk_test_files_detected.md | 2 +- ...windows_connhost_exe_started_forcefully.md | 2 +- ...indows_security_account_manager_stopped.md | 2 +- ...2020-11-09-common_ransomware_extensions.md | 2 +- .../2020-11-09-common_ransomware_notes.md | 2 +- .../2020-11-09-deleting_shadow_copies.md | 2 +- ...xcessive_account_lockouts_from_endpoint.md | 2 +- ..._system_network_configuration_discovery.md | 4 +- ...rohibited_applications_spawning_cmd_exe.md | 4 +- ...8-disabling_remote_user_account_control.md | 2 +- ...cution_of_file_with_multiple_extensions.md | 2 +- ...on_of_file_with_spaces_before_extension.md | 2 +- .../2020-11-23-processes_created_by_netsh.md | 2 +- ...installation_with_suspicious_parameters.md | 2 +- ...pulating_windows_services_registry_keys.md | 2 +- ...2-07-schtasks_used_for_forcing_a_reboot.md | 2 +- .../2020-12-08-shim_database_file_creation.md | 2 +- ...12-08-single_letter_process_on_endpoint.md | 2 +- ...processes_run_from_unexpected_locations.md | 4 +- .../2020-12-08-unusually_long_command_line.md | 2 +- ...i_permanent_event_subscription_-_sysmon.md | 2 +- ...burst_correlation_dll_and_network_event.md | 2 +- ...12-15-o365_suspicious_rights_delegation.md | 4 +- ..._of_login_failures_from_a_single_source.md | 2 +- .../2020-12-16-o365_pst_export_alert.md | 4 +- ...-o365_suspicious_admin_email_forwarding.md | 4 +- ...6-o365_suspicious_user_email_forwarding.md | 4 +- ...1-bcdedit_failure_recovery_modification.md | 2 +- docs/_posts/2021-01-06-supernova_webshell.md | 2 +- ...ng_keys_with_encrypt_policy_without_mfa.md | 4 +- ..._with_kms_keys_performing_encryption_s3.md | 4 +- ...ontrol_list_created_with_all_open_ports.md | 4 +- ...aws_network_access_control_list_deleted.md | 4 +- ...cious_microsoft_workflow_compiler_usage.md | 2 +- .../2021-01-12-suspicious_msbuild_spawn.md | 2 +- ...21-01-12-suspicious_mshta_child_process.md | 2 +- ..._connecting_to_dynamic_domain_providers.md | 4 +- ...ell_process_with_obfuscation_techniques.md | 2 +- ...cious_powershell_command-line_arguments.md | 2 +- ...20-detect_rundll32_inline_hta_execution.md | 2 +- .../2021-01-20-suspicious_mshta_spawn.md | 2 +- ...021-01-22-wbadmin_delete_system_backups.md | 2 +- ...l_access_by_provider_user_and_principal.md | 4 +- ...01-26-aws_saml_update_identity_provider.md | 4 +- ...-26-certutil_exe_certificate_extraction.md | 2 +- ...ws_security_hub_alerts_for_ec2_instance.md | 2 +- ...ike_in_aws_security_hub_alerts_for_user.md | 2 +- ...o365_add_app_role_assignment_grant_user.md | 4 +- ...1-01-26-o365_excessive_sso_logon_errors.md | 4 +- ...1-01-26-o365_new_federated_domain_added.md | 4 +- .../_posts/2021-01-26-revil_registry_entry.md | 2 +- ...1-27-detect_baron_samedit_cve-2021-3156.md | 2 +- ...baron_samedit_cve-2021-3156_via_osquery.md | 2 +- ...ect_regsvr32_application_control_bypass.md | 2 +- .../_posts/2021-01-28-ntdsutil_export_ntds.md | 2 +- ...cious_regsvr32_register_suspicious_path.md | 2 +- ...ct_baron_samedit_cve-2021-3156_segfault.md | 2 +- ...21-02-01-dump_lsass_via_procdump_rename.md | 2 +- ...32_application_control_bypass_-_advpack.md | 2 +- ...2_application_control_bypass_-_setupapi.md | 2 +- ...2_application_control_bypass_-_syssetup.md | 2 +- .../2021-02-04-suspicious_rundll32_startw.md | 2 +- ...9-suspicious_rundll32_dllregisterserver.md | 2 +- ...11-detect_html_help_spawn_child_process.md | 2 +- ...-02-12-detect_regasm_spawning_a_process.md | 2 +- ...02-12-detect_regsvcs_spawning_a_process.md | 2 +- ...2-22-suspicious_curl_network_connection.md | 2 +- .../2021-02-22-suspicious_plistbuddy_usage.md | 2 +- ...suspicious_plistbuddy_usage_via_osquery.md | 2 +- ...uspicious_sqlite3_lsquarantine_behavior.md | 2 +- .../_posts/2021-03-01-fodhelper_uac_bypass.md | 2 +- .../2021-03-01-ryuk_wake_on_lan_command.md | 2 +- ...us_scheduled_task_from_public_directory.md | 2 +- .../2021-03-02-aws_setdefaultpolicyversion.md | 4 +- ...ed_messaging_service_spawning_a_process.md | 2 +- ...-02-windows_disableantispyware_registry.md | 2 +- ...2021-03-03-nishang_powershelltcponeline.md | 2 +- docs/_posts/2021-03-03-w3wp_spawning_shell.md | 6 +- ...21-03-12-ransomware_notes_bulk_creation.md | 2 +- .../2021-03-12-resize_shadowstorage_volume.md | 2 +- ...3-16-high_process_termination_frequency.md | 2 +- ...16-windows_high_file_deletion_frequency.md | 2 +- .../2021-03-17-clop_common_exec_parameter.md | 2 +- ...3-17-clop_ransomware_known_service_name.md | 4 +- ...021-03-23-certutil_with_decode_argument.md | 6 +- ...021-03-29-powershell_start-bitstransfer.md | 2 +- ...03-31-aws_iam_successful_group_deletion.md | 4 +- ...021-03-31-disabling_firewall_with_netsh.md | 4 +- .../2021-03-31-dsquery_domain_discovery.md | 2 +- ...-aws_iam_assume_role_policy_brute_force.md | 4 +- .../2021-04-01-aws_iam_delete_policy.md | 4 +- ...21-04-01-aws_iam_failure_group_deletion.md | 4 +- ...icious_powershell_executed_as_a_service.md | 4 +- ...o_authenticate_from_host_using_kerberos.md | 2 +- ...heduled_task_created_within_public_path.md | 2 +- .../2021-04-12-excel_spawning_powershell.md | 2 +- ...4-12-excel_spawning_windows_script_host.md | 2 +- ...t_scheduled_task_created_to_spawn_shell.md | 2 +- .../2021-04-12-winword_spawning_powershell.md | 2 +- ...12-winword_spawning_windows_script_host.md | 2 +- ...1-04-13-aws_excessive_security_scanning.md | 4 +- ...ng_to_authenticate_from_host_using_ntlm.md | 2 +- ...rs_failing_to_authenticate_from_process.md | 2 +- ...otely_failing_to_authenticate_from_host.md | 2 +- ...fice_application_spawn_rundll32_process.md | 2 +- ...authenticate_using_explicit_credentials.md | 2 +- ...-office_document_creating_schedule_task.md | 2 +- ...14-office_document_executing_macro_code.md | 2 +- ..._users_failing_to_authenticate_kerberos.md | 2 +- ...sers_failed_authentication_via_kerberos.md | 2 +- ...-15-dns_exfiltration_using_nslookup_app.md | 2 +- ...ng_to_authenticate_from_host_using_ntlm.md | 2 +- ..._remote_thread_to_known_windows_process.md | 2 +- ...hedule_task_with_http_command_arguments.md | 2 +- ...dule_task_with_rundll32_command_trigger.md | 2 +- ...ess_connecting_to_ip_check_web_services.md | 2 +- ...9-wermgr_process_create_executable_file.md | 2 +- ...ocess_spawned_cmd_or_powershell_process.md | 6 +- ...1-04-21-excessive_usage_of_nslookup_app.md | 2 +- ...ultiple_archive_files_http_post_traffic.md | 2 +- .../2021-04-22-anomalous_usage_of_7zip.md | 2 +- ...e_product_spawning_rundll32_with_no_dll.md | 2 +- ...-04-22-plain_http_post_exfiltrated_data.md | 2 +- .../_posts/2021-04-22-winword_spawning_cmd.md | 4 +- ...04-26-office_product_spawning_bitsadmin.md | 2 +- ...-04-26-office_product_spawning_certutil.md | 6 +- ...021-04-26-office_product_spawning_mshta.md | 2 +- docs/_posts/2021-04-26-trickbot_named_pipe.md | 2 +- docs/_posts/2021-04-29-icacls_deny_command.md | 2 +- ...021-04-29-suspicious_driver_loaded_path.md | 2 +- docs/_posts/2021-04-29-xmrig_driver_loaded.md | 2 +- .../2021-05-04-deleting_of_net_users.md | 2 +- .../2021-05-04-disabling_net_user_account.md | 2 +- ...4-excessive_attempt_to_disable_services.md | 2 +- ...21-05-04-excessive_service_stop_attempt.md | 2 +- .../2021-05-04-excessive_usage_of_taskkill.md | 2 +- .../_posts/2021-05-04-icacls_grant_command.md | 2 +- ...21-05-04-process_kill_base_on_file_path.md | 4 +- ...2021-05-05-suspicious_process_file_path.md | 2 +- ...021-05-06-download_files_using_telegram.md | 2 +- ...merate_users_local_group_using_telegram.md | 2 +- .../2021-05-06-excessive_usage_of_net_app.md | 2 +- ...s_or_script_creation_in_suspicious_path.md | 2 +- ...2021-05-07-excessive_usage_of_cacls_app.md | 2 +- .../2021-05-07-schtasks_run_task_on_demand.md | 2 +- ...05-12-delete_shadowcopy_with_powershell.md | 4 +- ...2021-05-13-cmlua_or_cmstplua_uac_bypass.md | 2 +- docs/_posts/2021-05-13-slui_runas_elevated.md | 2 +- .../2021-05-13-slui_spawning_a_process.md | 2 +- .../2021-05-18-services_escalate_exe.md | 2 +- ...-allow_inbound_traffic_in_firewall_rule.md | 4 +- .../2021-05-19-mailsniper_invoke_functions.md | 4 +- .../2021-05-20-cmd_echo_pipe_-_escalation.md | 4 +- .../2021-05-21-winrm_spawning_a_process.md | 2 +- ...6-secretdumps_offline_ntds_dumping_tool.md | 2 +- ...27-detect_sharphound_file_modifications.md | 2 +- .../2021-05-27-detect_sharphound_usage.md | 2 +- ...etect_azurehound_command-line_arguments.md | 2 +- ...01-detect_azurehound_file_modifications.md | 2 +- ...etect_sharphound_command-line_arguments.md | 2 +- .../2021-06-02-conti_common_exec_parameter.md | 2 +- .../2021-06-02-modification_of_wallpaper.md | 2 +- .../2021-06-02-revil_common_exec_parameter.md | 2 +- ...021-06-02-wbemprox_com_object_execution.md | 2 +- ...-04-known_services_killed_by_ransomware.md | 4 +- ...-excessive_number_of_taskhost_processes.md | 2 +- ...ss_process_injection_via_getprocaddress.md | 4 +- ..._script_contains_base64_encoded_content.md | 4 +- ...re_with_powershell_script_block_logging.md | 4 +- ...tz_with_powershell_script_block_logging.md | 4 +- ...021-06-09-unloading_amsi_via_reflection.md | 4 +- ...ear_unallocated_sector_using_cipher_app.md | 2 +- .../2021-06-10-disable_logs_using_wevtutil.md | 2 +- ...rmission_modification_using_takeown_app.md | 2 +- ...-06-10-powershell_creating_thread_mutex.md | 4 +- ...021-06-10-powershell_domain_enumeration.md | 4 +- ...ading_dotnet_into_memory_via_reflection.md | 4 +- ...10-powershell_processing_stream_of_data.md | 4 +- ...ent_automatic_repair_mode_using_bcdedit.md | 2 +- .../2021-06-10-recon_using_wmi_class.md | 4 +- ...4-wmi_recon_running_process_or_services.md | 4 +- ...tect_wmi_event_subscription_persistence.md | 2 +- ...7-suspicious_event_log_service_behavior.md | 2 +- ...ecute_javascript_with_jscript_com_clsid.md | 2 +- ...-powershell_enable_smb1protocol_feature.md | 4 +- ...ursive_delete_of_directory_in_batch_cmd.md | 4 +- ...w_file_and_printing_sharing_in_firewall.md | 4 +- ...-23-allow_network_discovery_in_firewall.md | 4 +- ...4-excessive_usage_of_sc_service_utility.md | 2 +- ...er_of_service_control_start_as_disabled.md | 2 +- ...1-print_spooler_adding_a_printer_driver.md | 4 +- ...-print_spooler_failed_to_load_a_plug-in.md | 4 +- .../2021-07-01-spoolsv_spawning_rundll32.md | 2 +- ...07-01-spoolsv_suspicious_loaded_modules.md | 2 +- ...07-01-spoolsv_suspicious_process_access.md | 2 +- .../2021-07-01-spoolsv_writing_a_dll.md | 2 +- ...21-07-01-spoolsv_writing_a_dll_-_sysmon.md | 2 +- ...05-msmpeng_application_dll_side_loading.md | 2 +- ...-powershell_disable_security_monitoring.md | 2 +- ...-07-12-uac_bypass_mmc_load_unsigned_dll.md | 2 +- ...tance_created_by_previously_unseen_user.md | 2 +- .../2021-07-19-aws_createloginprofile.md | 4 +- .../2021-07-19-detect_new_open_s3_buckets.md | 4 +- ...detect_new_open_s3_buckets_over_aws_cli.md | 4 +- ...a_spawning_rundll32_or_regsvr32_process.md | 2 +- ...-07-19-office_product_spawn_cmd_process.md | 4 +- .../2021-07-20-detect_shared_ec2_snapshot.md | 2 +- ...of_shadowcopy_with_script_block_logging.md | 4 +- ...-07-23-sam_database_file_access_attempt.md | 2 +- ...-rundll32_createremotethread_in_browser.md | 2 +- ...rundll32_process_creating_exe_dll_files.md | 2 +- ...7-26-suspicious_icedid_rundll32_cmdline.md | 2 +- ...21-07-26-suspicious_rundll32_plugininit.md | 2 +- .../2021-07-27-chcp_command_execution.md | 2 +- ...gsvr32_with_known_silent_switch_cmdline.md | 2 +- ...dll32_create_remote_thread_to_a_process.md | 2 +- .../2021-07-30-drop_icedid_license_dat.md | 2 +- ...edid_exfiltrated_archived_file_creation.md | 2 +- ...fice_application_spawn_regsvr32_process.md | 2 +- ...2021-08-03-sqlite_module_in_temp_folder.md | 2 +- ...eate_remote_thread_in_shell_application.md | 2 +- .../2021-08-09-uninstall_app_using_msiexec.md | 2 +- docs/_posts/2021-08-11-fsutil_zeroing_file.md | 2 +- ...8-13-uac_bypass_with_colorui_com_object.md | 2 +- ...16-gsuite_drive_share_in_external_email.md | 2 +- ...8-16-gsuite_email_suspicious_attachment.md | 4 +- ...8-17-7zip_commandline_to_smb_share_path.md | 2 +- ...ws_ecr_container_scanning_findings_high.md | 4 +- ...ning_findings_low_informational_unknown.md | 4 +- ..._ecr_container_scanning_findings_medium.md | 4 +- ...mail_with_attachment_to_external_domain.md | 4 +- docs/_posts/2021-08-18-esentutl_sam_copy.md | 4 +- .../2021-08-18-powershell_4104_hunting.md | 2 +- ...container_upload_outside_business_hours.md | 4 +- ...9-aws_ecr_container_upload_unknown_user.md | 4 +- ...mail_suspicious_subject_with_attachment.md | 4 +- ...ols_passing_authentication_in_cleartext.md | 2 +- ...1-08-20-github_commit_changes_in_master.md | 2 +- ...2021-08-20-kubernetes_nginx_ingress_lfi.md | 2 +- ...2021-08-23-getlocaluser_with_powershell.md | 2 +- ...twmiobject_user_account_with_powershell.md | 2 +- ...er_account_with_powershell_script_block.md | 4 +- ...email_with_known_abuse_web_service_link.md | 4 +- ...8-23-gsuite_suspicious_shared_file_name.md | 2 +- ...2021-08-23-kubernetes_nginx_ingress_rfi.md | 2 +- ...21-08-24-adsisearcher_account_discovery.md | 4 +- ...4-domain_account_discovery_with_dsquery.md | 2 +- ...4-domain_account_discovery_with_net_app.md | 2 +- ...8-24-domain_account_discovery_with_wmic.md | 2 +- ...1-08-24-get-domaintrust_with_powershell.md | 2 +- ...omaintrust_with_powershell_script_block.md | 4 +- .../2021-08-24-get_aduser_with_powershell.md | 2 +- ...get_aduser_with_powershell_script_block.md | 4 +- ...21-08-24-get_domainuser_with_powershell.md | 2 +- ...24-getwmiobject_ds_user_with_powershell.md | 2 +- ...ct_ds_user_with_powershell_script_block.md | 4 +- ...-08-24-kubernetes_scanner_image_pulling.md | 2 +- ...omain_group_discovery_with_adsisearcher.md | 4 +- ...1-08-25-domain_group_discovery_with_net.md | 2 +- ...-08-25-domain_group_discovery_with_wmic.md | 2 +- ...08-25-elevated_group_discovery_with_net.md | 2 +- ...elevated_group_discovery_with_powerview.md | 4 +- ...8-25-elevated_group_discovery_with_wmic.md | 2 +- .../2021-08-25-getadgroup_with_powershell.md | 2 +- ...21-08-25-getdomaingroup_with_powershell.md | 2 +- ...-25-getnettcpconnection_with_powershell.md | 2 +- ...5-getwmiobject_ds_group_with_powershell.md | 2 +- ...t_ds_group_with_powershell_script_block.md | 4 +- ...ultdomainpasswordpolicy_with_powershell.md | 2 +- ...resultantpasswordpolicy_with_powershell.md | 2 +- ...wordpolicy_with_powershell_script_block.md | 4 +- ...-08-26-get_domainpolicy_with_powershell.md | 2 +- ...mainpolicy_with_powershell_script_block.md | 4 +- ...omaingroup_with_powershell_script_block.md | 4 +- ...8-26-password_policy_discovery_with_net.md | 2 +- ...reating_lnk_file_in_suspicious_location.md | 2 +- ...8-27-exchange_powershell_abuse_via_ssrf.md | 2 +- ...-08-27-exchange_powershell_module_usage.md | 4 +- ...domain_controller_discovery_with_nltest.md | 2 +- ...-08-30-remote_system_discovery_with_net.md | 2 +- ...petitpotam_network_share_access_request.md | 2 +- ...itpotam_suspicious_kerberos_tgt_request.md | 2 +- ...31-remote_system_discovery_with_dsquery.md | 2 +- ...1-09-01-circle_ci_disable_security_step.md | 2 +- ...1-domain_controller_discovery_with_wmic.md | 2 +- ...-01-domain_group_discovery_with_dsquery.md | 2 +- ...adcomputer_with_powershell_script_block.md | 4 +- ...s_computer_with_powershell_script_block.md | 4 +- .../2021-09-01-github_commit_in_develop.md | 2 +- .../2021-09-01-github_dependabot_alert.md | 2 +- ...1-github_pull_request_from_unknown_user.md | 2 +- ...mote_system_discovery_with_adsisearcher.md | 4 +- ...09-01-remote_system_discovery_with_wmic.md | 2 +- ...21-09-02-circle_ci_disable_security_job.md | 2 +- ...1-09-02-get-foresttrust_with_powershell.md | 2 +- ...oresttrust_with_powershell_script_block.md | 4 +- ...incomputer_with_powershell_script_block.md | 4 +- ...controller_with_powershell_script_block.md | 4 +- ...cdedit_command_back_to_normal_mode_boot.md | 2 +- ...change_to_safe_mode_with_network_config.md | 2 +- ...9-06-correlation_by_repository_and_risk.md | 2 +- ...2021-09-06-correlation_by_user_and_risk.md | 2 +- ...021-09-07-getadcomputer_with_powershell.md | 2 +- ...09-07-getdomaincomputer_with_powershell.md | 2 +- ...-07-getdomaincontroller_with_powershell.md | 2 +- ...etwmiobject_ds_computer_with_powershell.md | 2 +- ...e_by_app_connect_and_create_adsi_object.md | 2 +- ...-system_information_discovery_detection.md | 2 +- ...l_loading_from_world_writable_directory.md | 2 +- ...eate_local_admin_accounts_using_net_exe.md | 2 +- .../2021-09-08-office_spawning_control.md | 2 +- ...2021-09-08-rundll32_control_rundll_hunt.md | 2 +- ...control_rundll_world_writable_directory.md | 2 +- ...2021-09-09-extraction_of_registry_hives.md | 2 +- ...09-mshtml_module_load_in_office_product.md | 2 +- ...connection_with_powershell_script_block.md | 4 +- ...0-network_connection_discovery_with_arp.md | 2 +- ...0-network_connection_discovery_with_net.md | 2 +- ...twork_connection_discovery_with_netstat.md | 2 +- ...09-10-office_product_writing_cab_or_inf.md | 2 +- ...1-09-13-getcurrent_user_with_powershell.md | 2 +- ...-13-jscript_execution_using_cscript_app.md | 2 +- ...s_scripting_process_loading_ldap_module.md | 2 +- ...ms_scripting_process_loading_wmi_module.md | 2 +- ...9-13-office_application_drop_executable.md | 2 +- ...-09-13-system_user_discovery_with_query.md | 2 +- ...09-13-system_user_discovery_with_whoami.md | 2 +- ...user_discovery_with_env_vars_powershell.md | 2 +- ...21-09-13-xsl_script_execution_with_wmic.md | 4 +- ...-cmdline_tool_not_executed_in_cmd_shell.md | 2 +- ...021-09-14-get_wmiobject_group_discovery.md | 2 +- .../2021-09-14-net_localgroup_discovery.md | 2 +- ...-14-powershell_get_localgroup_discovery.md | 2 +- ...oup_discovery_with_script_block_logging.md | 4 +- .../_posts/2021-09-14-wmic_group_discovery.md | 2 +- ...1-09-15-check_elevated_cmd_using_whoami.md | 2 +- ...me_process_accessing_chrome_default_dir.md | 2 +- ...efox_process_access_firefox_profile_dir.md | 2 +- ...21-09-16-account_discovery_with_net_app.md | 2 +- ...t_to_add_certificate_to_untrusted_store.md | 6 +- ...edential_dump_from_registry_via_reg_exe.md | 4 +- ...2021-09-16-batch_file_write_to_system32.md | 2 +- .../_posts/2021-09-16-bits_job_persistence.md | 2 +- .../2021-09-16-bitsadmin_download_file.md | 2 +- ...of_shadow_copy_with_wmic_and_powershell.md | 4 +- ...mping_via_copy_command_from_shadow_copy.md | 4 +- ...tial_dumping_via_symlink_to_shadow_copy.md | 4 +- ...16-detect_html_help_url_in_command_line.md | 4 +- ...ml_help_using_infotech_storage_handlers.md | 4 +- ...09-16-detect_mshta_inline_hta_execution.md | 2 +- ...-09-16-detect_mshta_url_in_command_line.md | 2 +- ...9-16-detect_psexec_with_accepteula_flag.md | 2 +- .../_posts/2021-09-16-detect_renamed_7-zip.md | 2 +- .../2021-09-16-detect_renamed_rclone.md | 2 +- .../2021-09-16-detect_renamed_winrar.md | 2 +- .../2021-09-16-dump_lsass_via_procdump.md | 4 +- ...-09-16-local_account_discovery_with_net.md | 2 +- ...09-16-local_account_discovery_with_wmic.md | 4 +- ...2021-09-16-office_product_spawning_wmic.md | 4 +- .../2021-09-16-processes_launching_netsh.md | 4 +- ...ument_spawned_child_process_to_download.md | 2 +- ...mcos_rat_file_creation_in_remcos_folder.md | 2 +- ...icious_image_creation_in_appdata_folder.md | 2 +- ...1-suspicious_wav_file_in_appdata_folder.md | 2 +- ...1-09-27-change_default_file_association.md | 2 +- ...27-logon_script_event_trigger_execution.md | 2 +- ...-27-screensaver_event_trigger_execution.md | 2 +- ...9-28-print_processor_registry_autostart.md | 2 +- .../2021-09-29-verclsid_clsid_execution.md | 4 +- ...01-vbscript_execution_using_wscript_app.md | 2 +- ...ld_suspicious_spawned_by_script_process.md | 2 +- ...32_silent_and_install_param_dll_loading.md | 2 +- .../2021-10-05-detect_exchange_web_shell.md | 2 +- ...5-malicious_inprocserver32_modification.md | 2 +- ...1-10-05-process_writing_dynamicwrapperx.md | 2 +- .../2021-10-05-rundll32_shimcache_flush.md | 2 +- .../2021-10-05-suspicious_copy_on_system32.md | 2 +- .../2021-10-05-winhlp32_spawning_a_process.md | 2 +- ...ery_length_with_high_standard_deviation.md | 2 +- ...021-10-06-sdelete_application_execution.md | 2 +- ...ipt_or_cscript_suspicious_child_process.md | 2 +- .../2021-10-11-suspicious_wevtutil_usage.md | 2 +- ...rincipalnames_discovery_with_powershell.md | 4 +- ...iceprincipalnames_discovery_with_setspn.md | 2 +- .../2021-10-18-disable_schedule_task.md | 2 +- ...indows_curl_download_to_suspicious_path.md | 4 +- ...ows_task_scheduler_event_action_started.md | 2 +- ...-wmic_noninteractive_app_uninstallation.md | 2 +- ...21-10-24-gdrive_suspicious_file_sharing.md | 2 +- ...10-24-gsuite_suspicious_calendar_invite.md | 2 +- docs/_posts/2021-11-03-windows_adfind_exe.md | 2 +- .../2021-11-04-attacker_tools_on_endpoint.md | 2 +- ...ndows_curl_upload_to_remote_destination.md | 4 +- ...ows_service_creation_on_remote_endpoint.md | 2 +- ...s_service_initiation_on_remote_endpoint.md | 2 +- ...ocess_instantiation_via_winrm_and_winrs.md | 2 +- ...sk_creation_on_remote_endpoint_using_at.md | 2 +- ...uled_task_initiation_on_remote_endpoint.md | 2 +- .../2021-11-11-wmic_xsl_execution_via_url.md | 4 +- ...2-aws_iam_accessdenied_discovery_events.md | 4 +- ...21-11-12-csc_net_on_the_fly_compilation.md | 4 +- ...1-11-12-firewall_allowed_program_enable.md | 2 +- ...twork_discovery_using_route_windows_app.md | 4 +- ...12-remote_process_instantiation_via_wmi.md | 4 +- ...21-11-12-runas_execution_in_commandline.md | 4 +- ...12-windows_installutil_credential_theft.md | 2 +- ...12-windows_installutil_uninstall_option.md | 4 +- ...windows_installutil_url_in_command_line.md | 4 +- ...s_instantiation_via_dcom_and_powershell.md | 2 +- ...ss_instantiation_via_wmi_and_powershell.md | 2 +- ...ion_via_wmi_and_powershell_script_block.md | 4 +- .../2021-11-15-windows_diskcryptor_usage.md | 2 +- ...requency_copy_of_files_in_network_share.md | 2 +- ..._instantiation_via_winrm_and_powershell.md | 2 +- ...2021-11-17-windows_dism_remove_defender.md | 2 +- ...ile_written_in_administrative_smb_share.md | 2 +- .../2021-11-18-loading_of_dynwrapx_module.md | 2 +- ...info_gathering_using_dxdiag_application.md | 4 +- ...22-possible_browser_pass_view_parameter.md | 2 +- ...services_lolbas_execution_process_spawn.md | 2 +- ...-svchost_lolbas_execution_process_spawn.md | 2 +- ...ce_created_with_suspicious_service_path.md | 4 +- ...dows_service_created_within_public_path.md | 4 +- ...wmiprsve_lolbas_execution_process_spawn.md | 2 +- ...provhost_lolbas_execution_process_spawn.md | 2 +- ...1-23-mmc_lolbas_execution_process_spawn.md | 2 +- ...5-add_or_set_windows_defender_exclusion.md | 2 +- ...ell_windows_defender_exclusion_commands.md | 4 +- ...ndows_defender_exclusion_registry_entry.md | 2 +- ...-11-29-detect_rclone_command-line_usage.md | 2 +- ...sible_lateral_movement_powershell_spawn.md | 2 +- ...-randomly_generated_scheduled_task_name.md | 2 +- ...randomly_generated_windows_service_name.md | 2 +- ...r_of_computer_service_tickets_requested.md | 2 +- ...f_remote_endpoint_authentication_events.md | 2 +- .../2021-12-03-short_lived_scheduled_task.md | 2 +- ...-06-suspicious_linux_discovery_commands.md | 2 +- ...ion_service_writing_active_server_pages.md | 2 +- ...windows_raccine_scheduled_task_deletion.md | 2 +- ...-msi_module_loaded_by_non-system_binary.md | 2 +- ...-12-10-curl_download_and_bash_execution.md | 2 +- ...-12-11-wget_download_and_bash_execution.md | 2 +- ...2021-12-13-detect_outbound_ldap_traffic.md | 2 +- ..._class_file_download_by_java_user_agent.md | 2 +- .../2021-12-13-linux_java_spawning_shell.md | 4 +- ...og4shell_jndi_payload_injection_attempt.md | 2 +- ...load_injection_with_outbound_connection.md | 2 +- ...onnection_from_java_using_default_ports.md | 2 +- ...2021-12-13-windows_java_spawning_shells.md | 4 +- .../2021-12-14-hunting_for_log4shell.md | 2 +- ..._add_files_in_known_crontab_directories.md | 2 +- ...-17-linux_at_allow_config_file_creation.md | 2 +- ...1-12-17-linux_edit_cron_table_parameter.md | 2 +- ..._cronjob_entry_on_existing_cronjob_file.md | 2 +- ...ssible_cronjob_modification_with_editor.md | 2 +- ...ux_file_creation_in_init_boot_directory.md | 2 +- ...inux_file_creation_in_profile_directory.md | 2 +- ...e_append_command_to_profile_config_file.md | 2 +- ...rvice_file_created_in_systemd_directory.md | 2 +- .../2021-12-20-linux_service_restarted.md | 2 +- ...-12-20-linux_service_started_or_enabled.md | 2 +- ...suspicious_computer_account_name_change.md | 2 +- ...picious_kerberos_service_ticket_request.md | 2 +- .../2021-12-21-linux_add_user_account.md | 2 +- ...1-12-21-linux_change_file_owner_to_root.md | 2 +- ...21-linux_nopasswd_entry_in_sudoers_file.md | 2 +- ...-12-21-linux_setuid_using_chmod_utility.md | 2 +- ...12-21-linux_setuid_using_setcap_utility.md | 2 +- ...21-12-21-linux_visudo_utility_execution.md | 2 +- ...spicious_ticket_granting_ticket_request.md | 2 +- ...file_created_in_kernel_driver_directory.md | 2 +- ...sert_kernel_module_using_insmod_utility.md | 2 +- ...ll_kernel_module_using_modprobe_utility.md | 2 +- ...2-22-linux_preload_hijack_library_calls.md | 2 +- ...ux_common_process_for_elevation_control.md | 2 +- ...1-12-23-linux_sudoers_tmp_file_creation.md | 2 +- .../2022-01-04-linux_sudo_or_su_execution.md | 2 +- ...022-01-05-linux_doas_conf_file_creation.md | 2 +- .../2022-01-05-linux_doas_tool_execution.md | 2 +- ...nux_possible_access_to_credential_files.md | 2 +- ...0-linux_possible_access_to_sudoers_file.md | 2 +- ...ess_or_modification_of_sshd_config_file.md | 2 +- ...11-linux_possible_ssh_key_file_creation.md | 2 +- ..._connect_to_internet_with_hidden_window.md | 2 +- ..._hunting_system_account_targeting_lsass.md | 2 +- ...dows_non-system_account_targeting_lsass.md | 2 +- ...tentially_malicious_code_on_commandline.md | 2 +- ...-cmd_carry_out_string_command_parameter.md | 4 +- ...lateral_movement_commandline_parameters.md | 2 +- ...us_powershell_process_-_encoded_command.md | 2 +- ...shell_remove_windows_defender_directory.md | 4 +- ...cess_dns_query_known_abuse_web_services.md | 2 +- ...spicious_process_with_discord_dns_query.md | 2 +- ...dows_dotnet_binary_in_non_standard_path.md | 2 +- ...indows_installutil_in_non_standard_path.md | 4 +- ...ive_file_deletion_in_windefender_folder.md | 2 +- .../2022-01-20-ping_sleep_batch_command.md | 2 +- .../2022-01-21-windows_nirsoft_advancedrun.md | 2 +- .../2022-01-24-windows_nirsoft_utilities.md | 4 +- ...2-01-26-active_setup_registry_autostart.md | 2 +- ...dd_defaultuser_and_password_in_registry.md | 2 +- ...bound_traffic_by_firewall_rule_registry.md | 2 +- ...1-26-allow_operation_with_consent_admin.md | 2 +- ...022-01-26-disable_amsi_through_registry.md | 2 +- ...-26-disable_defender_antivirus_registry.md | 2 +- ...sable_defender_blockatfirstseen_feature.md | 2 +- ...-disable_defender_enhanced_notification.md | 2 +- ...1-26-disable_defender_mpengine_registry.md | 2 +- ...01-26-disable_defender_spynet_reporting.md | 2 +- ...defender_submit_samples_consent_feature.md | 2 +- ...6-log4shell_cve-2021-44228_exploitation.md | 2 +- ...1-26-registry_keys_used_for_persistence.md | 2 +- ...stry_keys_used_for_privilege_escalation.md | 2 +- ...26-remcos_client_registry_install_entry.md | 2 +- ...1-26-time_provider_persistence_registry.md | 2 +- ...2022-01-27-disable_etw_through_registry.md | 2 +- .../2022-01-27-disable_registry_tool.md | 2 +- ...ble_security_logs_using_minint_registry.md | 2 +- .../2022-01-27-disable_show_hidden_files.md | 2 +- ...22-01-27-disable_uac_remote_restriction.md | 2 +- .../2022-01-27-disable_windows_app_hotkeys.md | 2 +- ...-27-disable_windows_behavior_monitoring.md | 2 +- ...-disable_windows_smartscreen_protection.md | 2 +- .../2022-01-27-disabling_cmd_application.md | 2 +- .../2022-01-27-disabling_controlpanel.md | 2 +- ...-27-windows_possible_credential_dumping.md | 2 +- .../2022-01-28-disabling_defender_services.md | 2 +- ...disabling_folderoptions_windows_feature.md | 2 +- .../2022-01-28-disabling_norun_windows_app.md | 2 +- ...-28-disabling_systemrestore_in_registry.md | 2 +- .../2022-01-28-disabling_task_manager.md | 2 +- ...2-01-28-enable_rdp_in_other_port_number.md | 2 +- ...ble_wdigest_uselogoncredential_registry.md | 2 +- .../2022-01-28-etw_registry_disabled.md | 2 +- docs/_posts/2022-01-28-eventvwr_uac_bypass.md | 2 +- ...8-hide_user_account_from_sign-in_screen.md | 2 +- ...01-28-linux_pkexec_privilege_escalation.md | 2 +- ...tz_passtheticket_commandline_parameters.md | 2 +- ...22-02-01-rubeus_command_line_parameters.md | 2 +- ...nload_with_urlcache_and_split_arguments.md | 6 +- ...load_with_verifyctl_and_split_arguments.md | 6 +- ...2022-02-03-o365_added_service_principal.md | 4 +- ...22-02-03-o365_bypass_mfa_via_trusted_ip.md | 4 +- docs/_posts/2022-02-03-o365_disable_mfa.md | 4 +- ..._ticket_exports_through_winlogon_access.md | 2 +- ...dows_remote_assistance_spawning_process.md | 4 +- ...7-windows_schtasks_create_run_as_system.md | 2 +- ...022-02-08-rundll_loading_dll_by_ordinal.md | 2 +- ...r_of_kerberos_service_tickets_requested.md | 2 +- ...oasting_spn_request_with_rc4_encryption.md | 2 +- ...22-02-11-linux_system_network_discovery.md | 2 +- .../2022-02-14-linux_dd_file_overwrite.md | 2 +- .../2022-02-15-detection_of_dns_tunnels.md | 2 +- ...2-15-windows_diskshadow_proxy_execution.md | 4 +- ...22-02-15-windows_rasautou_dll_execution.md | 2 +- ...-17-windows_disable_notification_center.md | 2 +- ..._raw_access_to_master_boot_record_drive.md | 2 +- ...8-detect_regasm_with_network_connection.md | 2 +- ...-detect_regsvcs_with_network_connection.md | 2 +- ...authentication_discovery_with_powerview.md | 4 +- .../2022-02-18-net_profiler_uac_bypass.md | 2 +- ...excessive_authentication_failures_alert.md | 4 +- ...-process_deleting_its_process_file_path.md | 2 +- docs/_posts/2022-02-18-rundll32_dnsquery.md | 2 +- ...cution_policy_to_unrestricted_or_bypass.md | 2 +- ...uthentication_discovery_with_get-aduser.md | 4 +- ...ion_flag_disabled_in_useraccountcontrol.md | 2 +- ...heduled_task_deleted_or_created_via_cmd.md | 2 +- ...2-02-22-windows_wmi_process_call_create.md | 4 +- ...ndows_excessive_disabled_services_event.md | 4 +- ...dows_process_with_namedpipe_commandline.md | 2 +- ...s_service_creation_using_registry_entry.md | 2 +- ...022-02-24-aws_lambda_updatefunctioncode.md | 2 +- ...02-25-windows_disable_memory_crash_dump.md | 2 +- ...le_without_extension_in_critical_folder.md | 2 +- ...ows_raw_access_to_disk_volume_partition.md | 2 +- ...ve_distinct_processes_from_windows_temp.md | 2 +- ...ow_compress_color_and_info_tip_registry.md | 2 +- docs/_posts/2022-03-03-aws_createaccesskey.md | 4 +- .../2022-03-03-aws_updateloginprofile.md | 4 +- ...rberos_tgt_request_using_rc4_encryption.md | 2 +- docs/_posts/2022-03-04-macos_lolbin.md | 2 +- .../2022-03-08-suspicious_msbuild_path.md | 2 +- ...isable_change_password_through_registry.md | 2 +- ...ck_workstation_feature_through_registry.md | 2 +- ..._disable_logoff_button_through_registry.md | 2 +- ...isable_shutdown_button_through_registry.md | 2 +- ..._group_policy_features_through_registry.md | 2 +- ..._notification_features_through_registry.md | 2 +- ...own_process_using_the_kerberos_protocol.md | 2 +- .../2022-03-10-kerberos_user_enumeration.md | 2 +- ...t_regasm_with_no_command_line_arguments.md | 2 +- ..._regsvcs_with_no_command_line_arguments.md | 4 +- ..._no_command_line_arguments_with_network.md | 2 +- ..._no_command_line_arguments_with_network.md | 2 +- ...ice_ticket_request_using_rc4_encryption.md | 2 +- ..._no_command_line_arguments_with_network.md | 2 +- ...lhost_with_no_command_line_with_network.md | 2 +- ...cious_dllhost_no_command_line_arguments.md | 2 +- ...ious_gpupdate_no_command_line_arguments.md | 2 +- ...ious_rundll32_no_command_line_arguments.md | 2 +- ...hprotocolhost_no_command_line_arguments.md | 2 +- ...s_installutil_remote_network_connection.md | 4 +- ...stallutil_uninstall_option_with_network.md | 4 +- ...odify_acl_permission_to_files_or_folder.md | 2 +- ...wordpolicy_with_powershell_script_block.md | 4 +- ...domainuser_with_powershell_script_block.md | 4 +- ...oup_discovery_with_script_block_logging.md | 4 +- ...getadgroup_with_powershell_script_block.md | 4 +- ...rrent_user_with_powershell_script_block.md | 4 +- ...tlocaluser_with_powershell_script_block.md | 4 +- ...sion_on_remote_endpoint_with_powershell.md | 4 +- ...ntication_flag_disabled_with_powershell.md | 4 +- ...022-03-22-powershell_execute_com_object.md | 4 +- ...owershell_using_memory_as_backing_store.md | 4 +- ...3-22-recon_avproduct_through_pwh_or_wmi.md | 4 +- ...on_via_dcom_and_powershell_script_block.md | 4 +- ...n_via_winrm_and_powershell_script_block.md | 4 +- ...y_with_env_vars_powershell_script_block.md | 4 +- ...24-splunk_dos_via_malformed_s2s_request.md | 2 +- ...2022-03-28-sql_injection_with_long_urls.md | 2 +- ...try_by_a_non_critical_process_file_path.md | 2 +- ...uter_unconstrained_delegation_discovery.md | 4 +- ...view_unconstrained_delegation_discovery.md | 4 +- ...03-28-windows_terminating_lsass_process.md | 2 +- ...022-03-29-windows_iso_lnk_file_creation.md | 2 +- ...-30-windows_drivers_loaded_by_signature.md | 2 +- ...erview_constrained_delegation_discovery.md | 4 +- ...3-31-windows_registry_certificate_added.md | 2 +- ..._modification_for_safe_mode_persistence.md | 2 +- ...ithub_actions_disable_security_workflow.md | 2 +- ...4-windows_driver_load_non-standard_path.md | 4 +- ...4-04-windows_event_for_service_disabled.md | 4 +- .../2022-04-05-java_writing_jsp_file.md | 2 +- ...nux_stdout_redirection_to_dev_null_file.md | 2 +- ...-04-05-spring4shell_payload_url_request.md | 2 +- .../2022-04-05-web_jsp_request_via_url.md | 2 +- ...eb_spring_cloud_function_functionrouter.md | 2 +- ...indirect_command_execution_via_forfiles.md | 2 +- ...s_indirect_command_execution_via_pcalua.md | 2 +- ..._spring4shell_http_request_class_module.md | 2 +- .../2022-04-07-any_powershell_downloadfile.md | 2 +- ...022-04-07-any_powershell_downloadstring.md | 2 +- .../2022-04-07-detect_html_help_renamed.md | 2 +- .../_posts/2022-04-07-detect_mshta_renamed.md | 2 +- .../2022-04-07-detect_renamed_psexec.md | 2 +- ...ious_microsoft_workflow_compiler_rename.md | 2 +- .../2022-04-07-suspicious_msbuild_rename.md | 2 +- .../2022-04-07-suspicious_rundll32_rename.md | 2 +- ...unt_manipulation_of_ssh_config_and_keys.md | 2 +- .../2022-04-12-linux_deletion_of_cron_jobs.md | 2 +- ...12-linux_deletion_of_init_daemon_script.md | 2 +- .../2022-04-12-linux_deletion_of_services.md | 2 +- ...04-12-linux_deletion_of_ssl_certificate.md | 2 +- ...requency_of_file_deletion_in_etc_folder.md | 2 +- ...2-04-13-windows_registry_delete_task_sd.md | 2 +- ...022-04-18-nltest_domain_trust_discovery.md | 2 +- ...nux_adding_crontab_using_list_parameter.md | 2 +- ...ing_critical_directory_using_rm_command.md | 2 +- .../2022-04-22-linux_disable_services.md | 2 +- ...equency_of_file_deletion_in_boot_folder.md | 2 +- ...022-04-22-linux_shred_overwrite_command.md | 2 +- docs/_posts/2022-04-22-linux_stop_services.md | 2 +- ...rocesses_killed_by_industroyer2_malware.md | 2 +- ...ndows_linked_policies_in_adsi_discovery.md | 4 +- ...s_root_domain_linked_policies_discovery.md | 4 +- ...6-windows_hidden_schedule_task_settings.md | 2 +- ...-04-27-splunk_xss_in_monitoring_console.md | 2 +- ...ter_account_created_by_computer_account.md | 2 +- ...uter_account_requesting_kerberos_ticket.md | 2 +- ...windows_kerberos_local_successful_logon.md | 2 +- ...04-28-windows_computer_account_with_spn.md | 2 +- ...2022-04-29-path_traversal_spl_injection.md | 2 +- ...2-04-29-splunk_user_enumeration_attempt.md | 2 +- ...30-linux_iptables_firewall_modification.md | 2 +- ...worker_process_in_writable_process_path.md | 2 +- ...-02-windows_krbrelayup_service_creation.md | 4 +- ...ndows_service_create_kernel_mode_driver.md | 2 +- ...10-detect_aws_console_login_by_new_user.md | 2 +- ...ontrol_rest_vulnerability_cve-2022-1388.md | 2 +- .../2022-05-16-cobalt_strike_named_pipes.md | 2 +- .../2022-05-16-windows_system_file_on_disk.md | 2 +- ...e_policy_version_to_allow_all_resources.md | 4 +- ...are_server_side_template_injection_hunt.md | 2 +- ...eemarker_server-side_template_injection.md | 2 +- ...chtasks_scheduling_job_on_remote_system.md | 2 +- ...22-05-26-linux_at_application_execution.md | 2 +- ..._append_command_to_at_allow_config_file.md | 2 +- docs/_posts/2022-05-26-macos_plutil.md | 2 +- 896 files changed, 1281 insertions(+), 1269 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/mitre_enrichment.csv b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/mitre_enrichment.csv index 2719dde5e6..98e157fb74 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/mitre_enrichment.csv +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/mitre_enrichment.csv @@ -1,18 +1,30 @@ mitre_id,technique,tactics,groups +T1647,Plist File Modification,Defense Evasion,no +T1622,Debugger Evasion,Defense Evasion|Discovery,no +T1621,Multi-Factor Authentication Request Generation,Credential Access,APT29 +T1505.005,Terminal Services DLL,Persistence,no +T1557.003,DHCP Spoofing,Credential Access|Collection,no +T1595.003,Wordlist Scanning,Reconnaissance,Volatile Cedar +T1098.005,Device Registration,Persistence,APT29 +T1574.013,KernelCallbackTable,Persistence|Privilege Escalation|Defense Evasion,Lazarus Group +T1556.005,Reversible Encryption,Credential Access|Defense Evasion|Persistence,no +T1055.015,ListPlanting,Defense Evasion|Privilege Escalation,no +T1564.010,Process Argument Spoofing,Defense Evasion,no T1564.009,Resource Forking,Defense Evasion,no +T1559.003,XPC Services,Execution,no T1562.010,Downgrade Attack,Defense Evasion,no T1547.015,Login Items,Persistence|Privilege Escalation,no -T1620,Reflective Code Loading,Defense Evasion,no +T1620,Reflective Code Loading,Defense Evasion,Lazarus Group T1619,Cloud Storage Object Discovery,Discovery,no T1218.014,MMC,Defense Evasion,no T1218.013,Mavinject,Defense Evasion,no -T1614.001,System Language Discovery,Discovery,no +T1614.001,System Language Discovery,Discovery,Ke3chang|Lazarus Group T1615,Group Policy Discovery,Discovery,Turla T1036.007,Double File Extension,Defense Evasion,Mustang Panda T1562.009,Safe Mode Boot,Defense Evasion,no T1564.008,Email Hiding Rules,Defense Evasion,FIN4 T1505.004,IIS Components,Persistence,no -T1027.006,HTML Smuggling,Defense Evasion,no +T1027.006,HTML Smuggling,Defense Evasion,APT29 T1213.003,Code Repositories,Collection,APT29 T1553.006,Code Signing Policy Modification,Defense Evasion,Turla|APT39 T1614,System Location Discovery,Discovery,no @@ -25,14 +37,14 @@ T1053.007,Container Orchestration Job,Execution|Persistence|Privilege Escalation T1610,Deploy Container,Defense Evasion|Execution,TeamTNT T1609,Container Administration Command,Execution,TeamTNT T1608.005,Link Target,Resource Development,Silent Librarian -T1608.004,Drive-by Target,Resource Development,Transparent Tribe|APT32|Threat Group-3390 +T1608.004,Drive-by Target,Resource Development,Dragonfly|Transparent Tribe|APT32|Threat Group-3390 T1608.003,Install Digital Certificate,Resource Development,no -T1608.002,Upload Tool,Resource Development,Threat Group-3390 -T1608.001,Upload Malware,Resource Development,TeamTNT|APT32 -T1608,Stage Capabilities,Resource Development,no -T1016.001,Internet Connection Discovery,Discovery,APT29|Turla -T1553.005,Mark-of-the-Web Bypass,Defense Evasion,TA505 -T1555.005,Password Managers,Credential Access,Fox Kitten|Operation Wocao +T1608.002,Upload Tool,Resource Development,Lazarus Group|Threat Group-3390 +T1608.001,Upload Malware,Resource Development,Threat Group-3390|LazyScripter|Mustang Panda|Gamaredon Group|Kimsuky|Lazarus Group|TeamTNT|APT32 +T1608,Stage Capabilities,Resource Development,Mustang Panda +T1016.001,Internet Connection Discovery,Discovery,Gamaredon Group|APT29|Turla +T1553.005,Mark-of-the-Web Bypass,Defense Evasion,APT29|TA505 +T1555.005,Password Managers,Credential Access,Threat Group-3390|Fox Kitten|Operation Wocao T1484.002,Domain Trust Modification,Defense Evasion|Privilege Escalation,APT29 T1484.001,Group Policy Modification,Defense Evasion|Privilege Escalation,Indrik Spider T1547.014,Active Setup,Persistence|Privilege Escalation,no @@ -61,8 +73,8 @@ T1588.006,Vulnerabilities,Resource Development,Sandworm Team T1053.006,Systemd Timers,Execution|Persistence|Privilege Escalation,no T1562.008,Disable Cloud Logs,Defense Evasion,no T1547.012,Print Processors,Persistence|Privilege Escalation,no -T1598.003,Spearphishing Link,Reconnaissance,Magic Hound|Silent Librarian|Sidewinder|Sandworm Team|APT32|Kimsuky -T1598.002,Spearphishing Attachment,Reconnaissance,Sidewinder +T1598.003,Spearphishing Link,Reconnaissance,APT28|Dragonfly|Magic Hound|Silent Librarian|Sidewinder|Sandworm Team|APT32|Kimsuky +T1598.002,Spearphishing Attachment,Reconnaissance,Dragonfly|Sidewinder T1598.001,Spearphishing Service,Reconnaissance,no T1598,Phishing for Information,Reconnaissance,ZIRCONIUM|APT28 T1597.002,Purchase Technical Data,Reconnaissance,no @@ -74,23 +86,23 @@ T1596.003,Digital Certificates,Reconnaissance,no T1596.001,DNS/Passive DNS,Reconnaissance,no T1596.002,WHOIS,Reconnaissance,no T1596,Search Open Technical Databases,Reconnaissance,no -T1595.002,Vulnerability Scanning,Reconnaissance,TeamTNT|APT29|Volatile Cedar|APT28|Sandworm Team +T1595.002,Vulnerability Scanning,Reconnaissance,Magic Hound|Aquatic Panda|Dragonfly|TeamTNT|APT29|Volatile Cedar|APT28|Sandworm Team T1595.001,Scanning IP Blocks,Reconnaissance,TeamTNT T1595,Active Scanning,Reconnaissance,no -T1594,Search Victim-Owned Websites,Reconnaissance,Silent Librarian|Sandworm Team -T1593.002,Search Engines,Reconnaissance,no -T1593.001,Social Media,Reconnaissance,Kimsuky +T1594,Search Victim-Owned Websites,Reconnaissance,Kimsuky|Silent Librarian|Sandworm Team +T1593.002,Search Engines,Reconnaissance,Kimsuky +T1593.001,Social Media,Reconnaissance,Lazarus Group|Kimsuky T1593,Search Open Websites/Domains,Reconnaissance,Sandworm Team T1592.004,Client Configurations,Reconnaissance,HAFNIUM T1592.003,Firmware,Reconnaissance,no T1592.002,Software,Reconnaissance,Andariel|Sandworm Team T1592.001,Hardware,Reconnaissance,no T1592,Gather Victim Host Information,Reconnaissance,no -T1591.004,Identify Roles,Reconnaissance,no +T1591.004,Identify Roles,Reconnaissance,Lazarus Group T1591.003,Identify Business Tempo,Reconnaissance,no T1591.001,Determine Physical Locations,Reconnaissance,no -T1591.002,Business Relationships,Reconnaissance,Sandworm Team -T1591,Gather Victim Org Information,Reconnaissance,no +T1591.002,Business Relationships,Reconnaissance,Dragonfly|Sandworm Team +T1591,Gather Victim Org Information,Reconnaissance,Kimsuky|Lazarus Group T1590.006,Network Security Appliances,Reconnaissance,no T1590.005,IP Addresses,Reconnaissance,Andariel|HAFNIUM T1590.004,Network Topology,Reconnaissance,no @@ -98,40 +110,40 @@ T1590.003,Network Trust Dependencies,Reconnaissance,no T1590.002,DNS,Reconnaissance,no T1590.001,Domain Properties,Reconnaissance,Sandworm Team T1590,Gather Victim Network Information,Reconnaissance,HAFNIUM -T1589.003,Employee Names,Reconnaissance,Silent Librarian|Sandworm Team -T1589.002,Email Addresses,Reconnaissance,Kimsuky|Magic Hound|TA551|MuddyWater|HAFNIUM|APT32|Silent Librarian|Sandworm Team -T1589.001,Credentials,Reconnaissance,Leviathan|APT28|Magic Hound|Chimera +T1589.003,Employee Names,Reconnaissance,Kimsuky|Silent Librarian|Sandworm Team +T1589.002,Email Addresses,Reconnaissance,Lazarus Group|Kimsuky|Magic Hound|TA551|MuddyWater|HAFNIUM|APT32|Silent Librarian|Sandworm Team +T1589.001,Credentials,Reconnaissance,APT29|Leviathan|APT28|Magic Hound|Chimera T1589,Gather Victim Identity Information,Reconnaissance,Magic Hound|APT32 -T1588.005,Exploits,Resource Development,no -T1588.004,Digital Certificates,Resource Development,Lazarus Group|Silent Librarian -T1588.003,Code Signing Certificates,Resource Development,Wizard Spider -T1588.002,Tool,Resource Development,CostaRicto|Night Dragon|DarkVishnya|FIN5|Gorgon Group|Patchwork|Chimera|Dragonfly|Blue Mockingbird|Whitefly|APT41|FIN6|TEMP.Veles|Kimsuky|PittyTiger|Cobalt Group|APT29|Thrip|Ke3chang|DarkHydrus|APT32|APT38|BRONZE BUTLER|Carbanak|Cleaver|Inception|Leafminer|Threat Group-3390|Ferocious Kitten|IndigoZebra|BackdoorDiplomacy|menuPass|APT-C-36|Magic Hound|APT28|Wizard Spider|Frankenstein|Silence|WIRTE|Turla|APT33|APT19|FIN10|CopyKittens|APT39|APT1|MuddyWater|Silent Librarian|GALLIUM|Sandworm Team -T1588.001,Malware,Resource Development,Andariel|BackdoorDiplomacy|Turla|APT1 +T1588.005,Exploits,Resource Development,Kimsuky +T1588.004,Digital Certificates,Resource Development,BlackTech|Lazarus Group|Silent Librarian +T1588.003,Code Signing Certificates,Resource Development,BlackTech|Lazarus Group|Wizard Spider +T1588.002,Tool,Resource Development,Aquatic Panda|BlackTech|Lazarus Group|CostaRicto|Night Dragon|DarkVishnya|FIN5|Gorgon Group|Patchwork|Chimera|Dragonfly|Blue Mockingbird|Whitefly|APT41|FIN6|TEMP.Veles|Kimsuky|PittyTiger|Cobalt Group|APT29|Thrip|Ke3chang|DarkHydrus|APT32|APT38|BRONZE BUTLER|Carbanak|Cleaver|Inception|Leafminer|Threat Group-3390|Ferocious Kitten|IndigoZebra|BackdoorDiplomacy|menuPass|APT-C-36|Magic Hound|APT28|Wizard Spider|Frankenstein|Silence|WIRTE|Turla|APT33|APT19|FIN10|CopyKittens|APT39|APT1|MuddyWater|Silent Librarian|GALLIUM|Sandworm Team +T1588.001,Malware,Resource Development,Aquatic Panda|LazyScripter|Andariel|BackdoorDiplomacy|Turla|APT1 T1588,Obtain Capabilities,Resource Development,no T1587.004,Exploits,Resource Development,no T1587.003,Digital Certificates,Resource Development,APT29|PROMETHIUM T1587.002,Code Signing Certificates,Resource Development,PROMETHIUM|Patchwork -T1587.001,Malware,Resource Development,TeamTNT|APT29|Lazarus Group|Sandworm Team|Turla|FIN7|Night Dragon|Cleaver +T1587.001,Malware,Resource Development,Ke3chang|Kimsuky|TeamTNT|APT29|Lazarus Group|Sandworm Team|Turla|FIN7|Night Dragon|Cleaver T1587,Develop Capabilities,Resource Development,Kimsuky -T1586.002,Email Accounts,Resource Development,IndigoZebra|Leviathan|Magic Hound|Kimsuky +T1586.002,Email Accounts,Resource Development,APT29|APT28|IndigoZebra|Leviathan|Magic Hound|Kimsuky T1586.001,Social Media Accounts,Resource Development,Leviathan T1586,Compromise Accounts,Resource Development,no -T1585.002,Email Accounts,Resource Development,Leviathan|Magic Hound|Silent Librarian|Sandworm Team|APT1 -T1585.001,Social Media Accounts,Resource Development,Leviathan|Magic Hound|Fox Kitten|Sandworm Team|APT32|Cleaver +T1585.002,Email Accounts,Resource Development,Mustang Panda|Kimsuky|Lazarus Group|Leviathan|Magic Hound|Silent Librarian|Sandworm Team|APT1 +T1585.001,Social Media Accounts,Resource Development,Kimsuky|Lazarus Group|Leviathan|Magic Hound|Fox Kitten|Sandworm Team|APT32|Cleaver T1585,Establish Accounts,Resource Development,Fox Kitten|APT17 T1584.006,Web Services,Resource Development,Turla -T1584.005,Botnet,Resource Development,no -T1584.004,Server,Resource Development,Indrik Spider|Turla|APT16 +T1584.005,Botnet,Resource Development,Sandworm Team|Axiom +T1584.004,Server,Resource Development,Lazarus Group|Dragonfly|Indrik Spider|Turla|APT16 T1584.003,Virtual Private Server,Resource Development,Turla T1584.002,DNS Server,Resource Development,no -T1584.001,Domains,Resource Development,Transparent Tribe|Magic Hound|APT29|APT1 -T1583.006,Web Services,Resource Development,IndigoZebra|ZIRCONIUM|MuddyWater|HAFNIUM|Lazarus Group|Turla|APT32|APT17|APT29 +T1584.001,Domains,Resource Development,Kimsuky|Lazarus Group|Transparent Tribe|Magic Hound|APT29|APT1 +T1583.006,Web Services,Resource Development,APT28|Confucius|LazyScripter|Kimsuky|Magic Hound|IndigoZebra|ZIRCONIUM|MuddyWater|HAFNIUM|Lazarus Group|Turla|APT32|APT17|APT29 T1583.005,Botnet,Resource Development,no -T1583.004,Server,Resource Development,GALLIUM|Sandworm Team -T1583.003,Virtual Private Server,Resource Development,HAFNIUM|TEMP.Veles -T1583.002,DNS Server,Resource Development,no +T1583.004,Server,Resource Development,Kimsuky|Lazarus Group|Gelsemium|GALLIUM|Sandworm Team +T1583.003,Virtual Private Server,Resource Development,Axiom|Dragonfly|HAFNIUM|TEMP.Veles +T1583.002,DNS Server,Resource Development,Axiom T1584,Compromise Infrastructure,Resource Development,no -T1583.001,Domains,Resource Development,IndigoZebra|TeamTNT|Ferocious Kitten|FIN7|Transparent Tribe|Leviathan|Magic Hound|APT29|Mustang Panda|ZIRCONIUM|Lazarus Group|Silent Librarian|menuPass|Sandworm Team|APT32|Kimsuky|APT1|APT28 +T1583.001,Domains,Resource Development,LazyScripter|Gamaredon Group|Winnti Group|Dragonfly|IndigoZebra|TeamTNT|Ferocious Kitten|FIN7|Transparent Tribe|Leviathan|Magic Hound|APT29|Mustang Panda|ZIRCONIUM|Lazarus Group|Silent Librarian|menuPass|Sandworm Team|APT32|Kimsuky|APT1|APT28 T1583,Acquire Infrastructure,Resource Development,no T1564.007,VBA Stomping,Defense Evasion,no T1558.004,AS-REP Roasting,Credential Access,no @@ -145,7 +157,7 @@ T1574.012,COR_PROFILER,Persistence|Privilege Escalation|Defense Evasion,Blue Moc T1562.007,Disable or Modify Cloud Firewall,Defense Evasion,no T1098.004,SSH Authorized Keys,Persistence,TeamTNT T1480.001,Environmental Keying,Defense Evasion,APT41|Equation -T1059.007,JavaScript,Execution,Indrik Spider|MuddyWater|Turla|Higaisa|Sidewinder|Evilnum|Kimsuky|FIN6|APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer +T1059.007,JavaScript,Execution,LazyScripter|Indrik Spider|MuddyWater|Turla|Higaisa|Sidewinder|Evilnum|Kimsuky|FIN6|APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer T1578.004,Revert Cloud Instance,Defense Evasion,no T1578.003,Delete Cloud Instance,Defense Evasion,no T1578.001,Create Snapshot,Defense Evasion,no @@ -155,14 +167,14 @@ T1027.005,Indicator Removal from Tools,Defense Evasion,Operation Wocao|GALLIUM|T T1562.006,Indicator Blocking,Defense Evasion,no T1573.002,Asymmetric Cryptography,Command And Control,Operation Wocao|Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6 T1573.001,Symmetric Cryptography,Command And Control,Mustang Panda|Darkhotel|ZIRCONIUM|Higaisa|Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group -T1573,Encrypted Channel,Command And Control,Tropic Trooper +T1573,Encrypted Channel,Command And Control,APT29|Tropic Trooper T1027.004,Compile After Delivery,Defense Evasion,Gamaredon Group|Rocke|MuddyWater T1574.004,Dylib Hijacking,Persistence|Privilege Escalation|Defense Evasion,no T1546.015,Component Object Model Hijacking,Privilege Escalation|Persistence,APT28 -T1071.004,DNS,Command And Control,Chimera|APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7 +T1071.004,DNS,Command And Control,LazyScripter|Chimera|APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7 T1071.003,Mail Protocols,Command And Control,Turla|Kimsuky|APT32|SilverTerrier|APT28 T1071.002,File Transfer Protocols,Command And Control,Kimsuky|APT41|SilverTerrier|Honeybee -T1071.001,Web Protocols,Command And Control,TeamTNT|FIN8|APT29|Mustang Panda|Windshift|TA551|Higaisa|HAFNIUM|Sidewinder|Chimera|Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Rancor|Ke3chang|Orangeworm|APT37|APT19|Cobalt Group|Threat Group-3390|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|Magic Hound|APT32|OilRig|Gamaredon Group|Stealth Falcon +T1071.001,Web Protocols,Command And Control,Kimsuky|Confucius|TeamTNT|FIN8|APT29|Mustang Panda|Windshift|TA551|Higaisa|HAFNIUM|Sidewinder|Chimera|Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Rancor|Ke3chang|Orangeworm|APT37|APT19|Cobalt Group|Threat Group-3390|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|Magic Hound|APT32|OilRig|Gamaredon Group|Stealth Falcon T1572,Protocol Tunneling,Command And Control,Leviathan|CostaRicto|Chimera|Fox Kitten|OilRig|Cobalt Group|FIN6 T1048.003,Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol,Exfiltration,Wizard Spider|FIN6|APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,APT28|APT29 @@ -175,23 +187,23 @@ T1132.001,Standard Encoding,Command And Control,HAFNIUM|TA551|Sandworm Team|Trop T1090.004,Domain Fronting,Command And Control,APT29 T1090.003,Multi-hop Proxy,Command And Control,Leviathan|CostaRicto|APT28|Operation Wocao|Inception|FIN4|APT29 T1090.002,External Proxy,Command And Control,Tonto Team|APT39|Silence|GALLIUM|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28 -T1090.001,Internal Proxy,Command And Control,APT29|Higaisa|Operation Wocao|APT39|Strider +T1090.001,Internal Proxy,Command And Control,Lazarus Group|Turla|APT29|Higaisa|Operation Wocao|APT39|Strider T1102.003,One-Way Communication,Command And Control,Leviathan -T1102.002,Bidirectional Communication,Command And Control,ZIRCONIUM|MuddyWater|APT28|APT29|Sandworm Team|APT39|APT12|Turla|FIN7|APT37|Magic Hound|Carbanak +T1102.002,Bidirectional Communication,Command And Control,Kimsuky|Lazarus Group|ZIRCONIUM|MuddyWater|APT28|APT29|Sandworm Team|APT39|APT12|Turla|FIN7|APT37|Magic Hound|Carbanak T1102.001,Dead Drop Resolver,Command And Control,Rocke|APT41|BRONZE BUTLER|RTM|Patchwork -T1571,Non-Standard Port,Command And Control,Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7 +T1571,Non-Standard Port,Command And Control,WIRTE|Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7 T1074.002,Remote Data Staging,Collection,Leviathan|APT28|APT29|Chimera|Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8 -T1074.001,Local Data Staging,Collection,Indrik Spider|BackdoorDiplomacy|Mustang Panda|Sidewinder|Chimera|Kimsuky|APT39|Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|Honeybee|Dragonfly 2.0|Leviathan|APT3|FIN5|menuPass|Lazarus Group|Threat Group-3390|APT28 -T1078.004,Cloud Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT28|APT33 +T1074.001,Local Data Staging,Collection,Dragonfly|Indrik Spider|BackdoorDiplomacy|Mustang Panda|Sidewinder|Chimera|Kimsuky|APT39|Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|Honeybee|Dragonfly 2.0|Leviathan|APT3|FIN5|menuPass|Lazarus Group|Threat Group-3390|APT28 +T1078.004,Cloud Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Ke3chang|APT29|APT28|APT33 T1564.004,NTFS File Attributes,Defense Evasion,APT32 -T1564.003,Hidden Window,Defense Evasion,Nomadic Octopus|Higaisa|Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound -T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Kimsuky|HAFNIUM|Turla|Operation Wocao|PROMETHIUM|Tropic Trooper|FIN10|APT32 +T1564.003,Hidden Window,Defense Evasion,Gamaredon Group|Kimsuky|Nomadic Octopus|Higaisa|Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound +T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT29|Kimsuky|HAFNIUM|Turla|Operation Wocao|PROMETHIUM|Tropic Trooper|FIN10|APT32 T1078.002,Domain Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Naikon|Indrik Spider|Chimera|Operation Wocao|Sandworm Team|Wizard Spider|APT29|TA505|APT3|Threat Group-1314 T1078.001,Default Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,no -T1564.002,Hidden Users,Defense Evasion,Dragonfly 2.0 +T1564.002,Hidden Users,Defense Evasion,Kimsuky|Dragonfly|Dragonfly 2.0 T1574.006,Dynamic Linker Hijacking,Persistence|Privilege Escalation|Defense Evasion,APT41|Rocke -T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,Mustang Panda|Higaisa|BlackTech|Sidewinder|Chimera|BRONZE BUTLER|Naikon|APT41|GALLIUM|Tropic Trooper|APT19|Patchwork|APT32|APT3|menuPass|Threat Group-3390 -T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,BackdoorDiplomacy|Tonto Team|Evilnum|APT41|Whitefly|RTM|Threat Group-3390|menuPass +T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,Lazarus Group|Mustang Panda|Higaisa|BlackTech|Sidewinder|Chimera|BRONZE BUTLER|Naikon|APT41|GALLIUM|Tropic Trooper|APT19|Patchwork|APT32|APT3|menuPass|Threat Group-3390 +T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,Aquatic Panda|BackdoorDiplomacy|Tonto Team|Evilnum|APT41|Whitefly|RTM|Threat Group-3390|menuPass T1574.008,Path Interception by Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,no T1574.007,Path Interception by PATH Environment Variable,Persistence|Privilege Escalation|Defense Evasion,no T1574.009,Path Interception by Unquoted Path,Persistence|Privilege Escalation|Defense Evasion,no @@ -202,10 +214,10 @@ T1574,Hijack Execution Flow,Persistence|Privilege Escalation|Defense Evasion,no T1069.001,Local Groups,Discovery,Tonto Team|Chimera|Operation Wocao|Turla|OilRig|admin@338 T1570,Lateral Tool Transfer,Lateral Movement,Sandworm Team|Chimera|GALLIUM|Operation Wocao|APT32|Wizard Spider|Turla|FIN10 T1568.003,DNS Calculation,Command And Control,APT12 -T1204.002,Malicious File,Execution,Nomadic Octopus|Indrik Spider|APT38|Andariel|Ferocious Kitten|IndigoZebra|Transparent Tribe|Tonto Team|Magic Hound|Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|Kimsuky|FIN6|PROMETHIUM|APT30|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Dragonfly 2.0|FIN7|BRONZE BUTLER|Gorgon Group|OilRig|Dark Caracal|Cobalt Group|DarkHydrus|Rancor|Patchwork|APT32|APT19|MuddyWater|Lazarus Group|menuPass|APT37|Leviathan|TA459|APT29|APT28|FIN8|PLATINUM|Elderwood -T1204.001,Malicious Link,Execution,FIN7|Transparent Tribe|APT3|Magic Hound|APT28|APT29|Mustang Panda|Sidewinder|ZIRCONIUM|MuddyWater|Evilnum|Sandworm Team|Wizard Spider|Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|Turla|APT33 +T1204.002,Malicious File,Execution,LazyScripter|WIRTE|Confucius|Dragonfly|Threat Group-3390|Nomadic Octopus|Indrik Spider|APT38|Andariel|Ferocious Kitten|IndigoZebra|Transparent Tribe|Tonto Team|Magic Hound|Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|Kimsuky|FIN6|PROMETHIUM|APT30|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Dragonfly 2.0|FIN7|BRONZE BUTLER|Gorgon Group|OilRig|Dark Caracal|Cobalt Group|DarkHydrus|Rancor|Patchwork|APT32|APT19|MuddyWater|Lazarus Group|menuPass|APT37|Leviathan|TA459|APT29|APT28|FIN8|PLATINUM|Elderwood +T1204.001,Malicious Link,Execution,LazyScripter|Kimsuky|Lazarus Group|Confucius|FIN7|Transparent Tribe|APT3|Magic Hound|APT28|APT29|Mustang Panda|Sidewinder|ZIRCONIUM|MuddyWater|Evilnum|Sandworm Team|Wizard Spider|Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|Turla|APT33 T1195.003,Compromise Hardware Supply Chain,Initial Access,no -T1195.002,Compromise Software Supply Chain,Initial Access,APT29|Cobalt Group|GOLD SOUTHFIELD|Dragonfly|Sandworm Team|APT41 +T1195.002,Compromise Software Supply Chain,Initial Access,Gelsemium|Threat Group-3390|APT29|Cobalt Group|GOLD SOUTHFIELD|Dragonfly|Sandworm Team|APT41 T1195.001,Compromise Software Dependencies and Development Tools,Initial Access,no T1568.001,Fast Flux DNS,Command And Control,menuPass|TA505 T1052.001,Exfiltration over USB,Exfiltration,Mustang Panda|Tropic Trooper @@ -213,65 +225,65 @@ T1569.002,Service Execution,Execution,APT38|Chimera|Operation Wocao|Wizard Spide T1569.001,Launchctl,Execution,no T1569,System Services,Execution,no T1568.002,Domain Generation Algorithms,Command And Control,TA551|APT41 -T1568,Dynamic Resolution,Command And Control,Transparent Tribe|APT29 +T1568,Dynamic Resolution,Command And Control,Gamaredon Group|Gelsemium|Transparent Tribe|APT29 T1011.001,Exfiltration Over Bluetooth,Exfiltration,no -T1567.002,Exfiltration to Cloud Storage,Exfiltration,FIN7|ZIRCONIUM|HAFNIUM|Chimera|Leviathan|Turla +T1567.002,Exfiltration to Cloud Storage,Exfiltration,Kimsuky|Threat Group-3390|Confucius|Lazarus Group|FIN7|ZIRCONIUM|HAFNIUM|Chimera|Leviathan|Turla T1567.001,Exfiltration to Code Repository,Exfiltration,no -T1059.006,Python,Execution,Tonto Team|APT37|ZIRCONIUM|MuddyWater|Turla|Operation Wocao|Kimsuky|APT29|Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete -T1059.005,Visual Basic,Execution,OilRig|APT38|Transparent Tribe|APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|APT39|Machete|Operation Wocao|Kimsuky|APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound +T1059.006,Python,Execution,Dragonfly|Tonto Team|APT37|ZIRCONIUM|MuddyWater|Turla|Operation Wocao|Kimsuky|APT29|Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete +T1059.005,Visual Basic,Execution,Confucius|Lazarus Group|LazyScripter|OilRig|APT38|Transparent Tribe|APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|APT39|Machete|Operation Wocao|Kimsuky|APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound T1059.004,Unix Shell,Execution,TeamTNT|Rocke|APT41 -T1059.003,Windows Command Shell,Execution,Sandworm Team|Nomadic Octopus|TeamTNT|APT29|Mustang Panda|ZIRCONIUM|TA551|Higaisa|Indrik Spider|Chimera|Fox Kitten|Machete|Operation Wocao|Wizard Spider|FIN6|TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|GALLIUM|Turla|Silence|APT32|Darkhotel|MuddyWater|APT18|APT38|Gorgon Group|Dark Caracal|Ke3chang|Dragonfly 2.0|Rancor|FIN8|APT28|APT37|Magic Hound|BRONZE BUTLER|Sowbug|menuPass|FIN10|Threat Group-3390|Gamaredon Group|Patchwork|Suckfly|Threat Group-1314|APT3|admin@338|APT1 +T1059.003,Windows Command Shell,Execution,Kimsuky|Aquatic Panda|Dragonfly|LazyScripter|Sandworm Team|Nomadic Octopus|TeamTNT|APT29|Mustang Panda|ZIRCONIUM|TA551|Higaisa|Indrik Spider|Chimera|Fox Kitten|Machete|Operation Wocao|Wizard Spider|FIN6|TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|GALLIUM|Turla|Silence|APT32|Darkhotel|MuddyWater|APT18|APT38|Gorgon Group|Dark Caracal|Ke3chang|Dragonfly 2.0|Rancor|FIN8|APT28|APT37|Magic Hound|BRONZE BUTLER|Sowbug|menuPass|FIN10|Threat Group-3390|Gamaredon Group|Patchwork|Suckfly|Threat Group-1314|APT3|admin@338|APT1 T1059.002,AppleScript,Execution,no -T1059.001,PowerShell,Execution,Nomadic Octopus|TeamTNT|APT38|Tonto Team|Mustang Panda|Indrik Spider|HAFNIUM|Sidewinder|Fox Kitten|GOLD SOUTHFIELD|Sandworm Team|Operation Wocao|Chimera|Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|GALLIUM|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|Thrip|Cobalt Group|APT28|DarkHydrus|Dragonfly 2.0|APT19|Gorgon Group|TA459|Leviathan|MuddyWater|FIN8|CopyKittens|OilRig|Magic Hound|BRONZE BUTLER|FIN7|APT32|menuPass|FIN10|Threat Group-3390|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda +T1059.001,PowerShell,Execution,Gamaredon Group|Lazarus Group|Aquatic Panda|Confucius|Dragonfly|LazyScripter|Nomadic Octopus|TeamTNT|APT38|Tonto Team|Mustang Panda|Indrik Spider|HAFNIUM|Sidewinder|Fox Kitten|GOLD SOUTHFIELD|Sandworm Team|Operation Wocao|Chimera|Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|GALLIUM|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|Thrip|Cobalt Group|APT28|DarkHydrus|Dragonfly 2.0|APT19|Gorgon Group|TA459|Leviathan|MuddyWater|FIN8|CopyKittens|OilRig|Magic Hound|BRONZE BUTLER|FIN7|APT32|menuPass|FIN10|Threat Group-3390|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda T1567,Exfiltration Over Web Service,Exfiltration,APT28 T1497.003,Time Based Evasion,Defense Evasion|Discovery,no T1497.002,User Activity Based Checks,Defense Evasion|Discovery,Darkhotel|FIN7 -T1497.001,System Checks,Defense Evasion|Discovery,OilRig|Darkhotel|Evilnum|Frankenstein +T1497.001,System Checks,Defense Evasion|Discovery,Lazarus Group|OilRig|Darkhotel|Evilnum|Frankenstein T1498.002,Reflection Amplification,Impact,no T1498.001,Direct Network Flood,Impact,no -T1566.003,Spearphishing via Service,Initial Access,APT29|Ajax Security Team|Magic Hound|Windshift|FIN6|OilRig|Dark Caracal -T1566.002,Spearphishing Link,Initial Access,Transparent Tribe|FIN7|APT3|Mustang Panda|ZIRCONIUM|MuddyWater|Sidewinder|Evilnum|Sandworm Team|Wizard Spider|APT1|Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|APT39|FIN4|APT32|Night Dragon|APT28|Cobalt Group|Turla|Dragonfly 2.0|OilRig|Elderwood|APT33|APT29|Leviathan|FIN8|Patchwork|Magic Hound -T1566.001,Spearphishing Attachment,Initial Access,APT38|Andariel|Ferocious Kitten|IndigoZebra|Transparent Tribe|Nomadic Octopus|Tonto Team|Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|APT1|FIN6|APT30|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|DarkHydrus|Lazarus Group|Gorgon Group|OilRig|BRONZE BUTLER|APT19|APT32|Cobalt Group|Rancor|FIN7|Dragonfly 2.0|MuddyWater|APT28|TA459|APT29|APT37|Leviathan|FIN8|Patchwork|menuPass|Elderwood|PLATINUM -T1566,Phishing,Initial Access,GOLD SOUTHFIELD|Dragonfly +T1566.003,Spearphishing via Service,Initial Access,Lazarus Group|APT29|Ajax Security Team|Magic Hound|Windshift|FIN6|OilRig|Dark Caracal +T1566.002,Spearphishing Link,Initial Access,Lazarus Group|Confucius|LazyScripter|Transparent Tribe|FIN7|APT3|Mustang Panda|ZIRCONIUM|MuddyWater|Sidewinder|Evilnum|Sandworm Team|Wizard Spider|APT1|Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|APT39|FIN4|APT32|Night Dragon|APT28|Cobalt Group|Turla|Dragonfly 2.0|OilRig|Elderwood|APT33|APT29|Leviathan|FIN8|Patchwork|Magic Hound +T1566.001,Spearphishing Attachment,Initial Access,WIRTE|Confucius|Dragonfly|LazyScripter|Threat Group-3390|APT38|Andariel|Ferocious Kitten|IndigoZebra|Transparent Tribe|Nomadic Octopus|Tonto Team|Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|APT1|FIN6|APT30|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|DarkHydrus|Lazarus Group|Gorgon Group|OilRig|BRONZE BUTLER|APT19|APT32|Cobalt Group|Rancor|FIN7|Dragonfly 2.0|MuddyWater|APT28|TA459|APT29|APT37|Leviathan|FIN8|Patchwork|menuPass|Elderwood|PLATINUM +T1566,Phishing,Initial Access,Axiom|GOLD SOUTHFIELD|Dragonfly T1565.003,Runtime Data Manipulation,Impact,APT38 T1565.002,Transmitted Data Manipulation,Impact,APT38 T1565.001,Stored Data Manipulation,Impact,APT38 T1565,Data Manipulation,Impact,no T1564.001,Hidden Files and Directories,Defense Evasion,Transparent Tribe|Mustang Panda|Rocke|APT32|Tropic Trooper|APT28|Lazarus Group T1564,Hide Artifacts,Defense Evasion,no -T1563.002,RDP Hijacking,Lateral Movement,no +T1563.002,RDP Hijacking,Lateral Movement,Axiom T1563.001,SSH Hijacking,Lateral Movement,no T1563,Remote Service Session Hijacking,Lateral Movement,no -T1518.001,Security Software Discovery,Discovery,TeamTNT|APT38|Windshift|Sidewinder|Operation Wocao|Wizard Spider|Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon +T1518.001,Security Software Discovery,Discovery,Kimsuky|Aquatic Panda|TeamTNT|APT38|Windshift|Sidewinder|Operation Wocao|Wizard Spider|Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon T1069.003,Cloud Groups,Discovery,no -T1069.002,Domain Groups,Discovery,Turla|Inception|OilRig|Dragonfly 2.0|Ke3chang -T1087.004,Cloud Account,Discovery,no +T1069.002,Domain Groups,Discovery,APT29|Dragonfly|Turla|Inception|OilRig|Dragonfly 2.0|Ke3chang +T1087.004,Cloud Account,Discovery,APT29 T1087.003,Email Account,Discovery,Sandworm Team|TA505 -T1087.002,Domain Account,Discovery,MuddyWater|Fox Kitten|Operation Wocao|Wizard Spider|Chimera|Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang +T1087.002,Domain Account,Discovery,APT29|Lazarus Group|Dragonfly|MuddyWater|Fox Kitten|Operation Wocao|Wizard Spider|Chimera|Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang T1087.001,Local Account,Discovery,Chimera|Fox Kitten|Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338 T1553.004,Install Root Certificate,Defense Evasion,no -T1562.004,Disable or Modify System Firewall,Defense Evasion,TeamTNT|APT38|APT29|Operation Wocao|Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak +T1562.004,Disable or Modify System Firewall,Defense Evasion,Dragonfly|TeamTNT|APT38|APT29|Operation Wocao|Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak T1562.003,Impair Command History Logging,Defense Evasion,APT38 T1562.002,Disable Windows Event Logging,Defense Evasion,Sandworm Team|APT29|Threat Group-3390 -T1562.001,Disable or Modify Tools,Defense Evasion,TeamTNT|Indrik Spider|APT29|MuddyWater|Wizard Spider|FIN6|Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda +T1562.001,Disable or Modify Tools,Defense Evasion,Aquatic Panda|TeamTNT|Indrik Spider|APT29|MuddyWater|Wizard Spider|FIN6|Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda T1562,Impair Defenses,Defense Evasion,no -T1003.004,LSA Secrets,Credential Access,OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390 +T1003.004,LSA Secrets,Credential Access,Dragonfly|OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390 T1003.005,Cached Domain Credentials,Credential Access,OilRig|MuddyWater|Leafminer|APT33 T1561.002,Disk Structure Wipe,Impact,Sandworm Team|Lazarus Group|APT38|APT37 T1561.001,Disk Content Wipe,Impact,Lazarus Group T1561,Disk Wipe,Impact,no T1560.003,Archive via Custom Method,Collection,Mustang Panda|Lazarus Group|Kimsuky|CopyKittens|FIN6 T1560.002,Archive via Library,Collection,Lazarus Group|Threat Group-3390 -T1560.001,Archive via Utility,Collection,APT28|APT29|Mustang Panda|HAFNIUM|Fox Kitten|Operation Wocao|Chimera|APT41|GALLIUM|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|APT1|Ke3chang -T1560,Archive Collected Data,Collection,Leviathan|menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang +T1560.001,Archive via Utility,Collection,Kimsuky|Aquatic Panda|APT28|APT29|Mustang Panda|HAFNIUM|Fox Kitten|Operation Wocao|Chimera|APT41|GALLIUM|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|APT1|Ke3chang +T1560,Archive Collected Data,Collection,Axiom|Dragonfly|Leviathan|menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang T1499.004,Application or System Exploitation,Impact,no T1499.003,Application Exhaustion Flood,Impact,no T1499.002,Service Exhaustion Flood,Impact,no T1499.001,OS Exhaustion Flood,Impact,no T1491.002,External Defacement,Impact,Sandworm Team -T1491.001,Internal Defacement,Impact,Lazarus Group +T1491.001,Internal Defacement,Impact,Gamaredon Group|Lazarus Group T1114.003,Email Forwarding Rule,Collection,Silent Librarian|Kimsuky -T1114.002,Remote Email Collection,Collection,APT29|HAFNIUM|Chimera|APT1|FIN4|Ke3chang|Leafminer|Dragonfly 2.0|APT28 +T1114.002,Remote Email Collection,Collection,Kimsuky|Dragonfly|APT29|HAFNIUM|Chimera|APT1|FIN4|Ke3chang|Leafminer|Dragonfly 2.0|APT28 T1114.001,Local Email Collection,Collection,Chimera|Magic Hound|APT1 T1134.005,SID-History Injection,Defense Evasion|Privilege Escalation,no T1134.004,Parent PID Spoofing,Defense Evasion|Privilege Escalation,no @@ -280,7 +292,7 @@ T1134.002,Create Process with Token,Defense Evasion|Privilege Escalation,Turla|L T1134.001,Token Impersonation/Theft,Defense Evasion|Privilege Escalation,FIN8|APT28 T1213.002,Sharepoint,Collection,Chimera|Ke3chang|APT28 T1213.001,Confluence,Collection,no -T1555.003,Credentials from Web Browsers,Credential Access,Ajax Security Team|ZIRCONIUM|FIN6|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|MuddyWater|APT37|Patchwork|Molerats +T1555.003,Credentials from Web Browsers,Credential Access,APT29|Ajax Security Team|ZIRCONIUM|FIN6|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|MuddyWater|APT37|Patchwork|Molerats T1555.002,Securityd Memory,Credential Access,no T1555.001,Keychain,Credential Access,no T1559.002,Dynamic Data Exchange,Execution,Leviathan|Sidewinder|Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|FIN7|APT28 @@ -289,7 +301,7 @@ T1559,Inter-Process Communication,Execution,no T1558.002,Silver Ticket,Credential Access,no T1558.001,Golden Ticket,Credential Access,Ke3chang T1558,Steal or Forge Kerberos Tickets,Credential Access,no -T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,Wizard Spider +T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,Lazarus Group|Wizard Spider T1557,Adversary-in-the-Middle,Credential Access|Collection,Kimsuky T1556.002,Password Filter DLL,Credential Access|Defense Evasion|Persistence,Strider T1556.001,Domain Controller Authentication,Credential Access|Defense Evasion|Persistence,Chimera @@ -305,32 +317,32 @@ T1003.007,Proc Filesystem,Credential Access,no T1003.006,DCSync,Credential Access,APT29|Operation Wocao T1558.003,Kerberoasting,Credential Access,FIN7|APT29|Operation Wocao|Wizard Spider T1552.006,Group Policy Preferences,Credential Access,APT33 -T1003.003,NTDS,Credential Access,APT28|Mustang Panda|HAFNIUM|Fox Kitten|menuPass|Wizard Spider|Chimera|FIN6|Dragonfly 2.0 -T1003.002,Security Account Manager,Credential Access,Wizard Spider|Threat Group-3390|Ke3chang|GALLIUM|Night Dragon|Dragonfly 2.0|menuPass -T1003.001,LSASS Memory,Credential Access,Indrik Spider|HAFNIUM|Fox Kitten|Operation Wocao|Kimsuky|Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|GALLIUM|TEMP.Veles|APT33|APT39|APT32|Leafminer|Magic Hound|FIN8|PLATINUM|MuddyWater|OilRig|BRONZE BUTLER|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver +T1003.003,NTDS,Credential Access,Ke3chang|Dragonfly|APT28|Mustang Panda|HAFNIUM|Fox Kitten|menuPass|Wizard Spider|Chimera|FIN6|Dragonfly 2.0 +T1003.002,Security Account Manager,Credential Access,Dragonfly|Wizard Spider|Threat Group-3390|Ke3chang|GALLIUM|Night Dragon|Dragonfly 2.0|menuPass +T1003.001,LSASS Memory,Credential Access,Aquatic Panda|Indrik Spider|HAFNIUM|Fox Kitten|Operation Wocao|Kimsuky|Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|GALLIUM|TEMP.Veles|APT33|APT39|APT32|Leafminer|Magic Hound|FIN8|PLATINUM|MuddyWater|OilRig|BRONZE BUTLER|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver T1110.004,Credential Stuffing,Credential Access,Chimera T1110.003,Password Spraying,Credential Access,Sandworm Team|APT29|Silent Librarian|Chimera|APT28|APT33|Leafminer|Lazarus Group -T1110.002,Password Cracking,Credential Access,FIN6|APT41|Dragonfly 2.0|APT3 +T1110.002,Password Cracking,Credential Access,Dragonfly|FIN6|APT41|Dragonfly 2.0|APT3 T1110.001,Password Guessing,Credential Access,APT28 T1021.006,Windows Remote Management,Lateral Movement,APT29|Chimera|Wizard Spider|Threat Group-3390 -T1021.005,VNC,Lateral Movement,FIN7|Fox Kitten|GCMAN -T1021.004,SSH,Lateral Movement,TeamTNT|FIN7|Fox Kitten|Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN +T1021.005,VNC,Lateral Movement,Gamaredon Group|FIN7|Fox Kitten|GCMAN +T1021.004,SSH,Lateral Movement,BlackTech|Lazarus Group|TeamTNT|FIN7|Fox Kitten|Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN T1021.003,Distributed Component Object Model,Lateral Movement,no -T1021.002,SMB/Windows Admin Shares,Lateral Movement,Sandworm Team|APT28|Fox Kitten|APT41|Operation Wocao|Wizard Spider|Chimera|Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang -T1021.001,Remote Desktop Protocol,Lateral Movement,Kimsuky|FIN7|Fox Kitten|Chimera|Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|FIN10|menuPass|Patchwork|FIN6|Lazarus Group|APT1|Axiom +T1021.002,SMB/Windows Admin Shares,Lateral Movement,APT29|Sandworm Team|APT28|Fox Kitten|APT41|Operation Wocao|Wizard Spider|Chimera|Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang +T1021.001,Remote Desktop Protocol,Lateral Movement,APT29|Dragonfly|Kimsuky|FIN7|Fox Kitten|Chimera|Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|FIN10|menuPass|Patchwork|FIN6|Lazarus Group|APT1|Axiom T1554,Compromise Client Software Binary,Persistence,no T1036.006,Space after Filename,Defense Evasion,no -T1036.005,Match Legitimate Name or Location,Defense Evasion,APT28|Ferocious Kitten|FIN7|BackdoorDiplomacy|Transparent Tribe|Naikon|APT29|Mustang Panda|Sidewinder|Darkhotel|Lazarus Group|Indrik Spider|Fox Kitten|Machete|Chimera|PROMETHIUM|Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|Sowbug|BRONZE BUTLER|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1 -T1036.004,Masquerade Task or Service,Defense Evasion,BackdoorDiplomacy|APT41|Naikon|ZIRCONIUM|APT29|Higaisa|Fox Kitten|Kimsuky|PROMETHIUM|Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7 -T1036.003,Rename System Utilities,Defense Evasion,menuPass|APT32|GALLIUM +T1036.005,Match Legitimate Name or Location,Defense Evasion,Ke3chang|Kimsuky|Gamaredon Group|WIRTE|APT28|Ferocious Kitten|FIN7|BackdoorDiplomacy|Transparent Tribe|Naikon|APT29|Mustang Panda|Sidewinder|Darkhotel|Lazarus Group|Indrik Spider|Fox Kitten|Machete|Chimera|PROMETHIUM|Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|Sowbug|BRONZE BUTLER|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1 +T1036.004,Masquerade Task or Service,Defense Evasion,Lazarus Group|BackdoorDiplomacy|APT41|Naikon|ZIRCONIUM|APT29|Higaisa|Fox Kitten|Kimsuky|PROMETHIUM|Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7 +T1036.003,Rename System Utilities,Defense Evasion,Lazarus Group|menuPass|APT32|GALLIUM T1036.002,Right-to-Left Override,Defense Evasion,Ferocious Kitten|BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic T1036.001,Invalid Code Signature,Defense Evasion,Windshift|APT37 T1553.003,SIP and Trust Provider Hijacking,Defense Evasion,no -T1553.002,Code Signing,Defense Evasion,menuPass|APT29|GALLIUM|Wizard Spider|Kimsuky|PROMETHIUM|Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel +T1553.002,Code Signing,Defense Evasion,Lazarus Group|menuPass|APT29|GALLIUM|Wizard Spider|Kimsuky|PROMETHIUM|Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel T1553.001,Gatekeeper Bypass,Defense Evasion,no -T1553,Subvert Trust Controls,Defense Evasion,no +T1553,Subvert Trust Controls,Defense Evasion,Axiom T1027.003,Steganography,Defense Evasion,Andariel|Leviathan|TA551|BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37 -T1027.002,Software Packing,Defense Evasion,Sandworm Team|Kimsuky|TeamTNT|ZIRCONIUM|TA505|Rocke|GALLIUM|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon +T1027.002,Software Packing,Defense Evasion,Threat Group-3390|Lazarus Group|Sandworm Team|Kimsuky|TeamTNT|ZIRCONIUM|TA505|Rocke|GALLIUM|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon T1027.001,Binary Padding,Defense Evasion,APT29|Mustang Panda|Higaisa|Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee T1222.002,Linux and Mac File and Directory Permissions Modification,Defense Evasion,TeamTNT|Rocke|APT32 T1222.001,Windows File and Directory Permissions Modification,Defense Evasion,Wizard Spider @@ -342,10 +354,10 @@ T1552,Unsecured Credentials,Credential Access,no T1216.001,PubPrn,Defense Evasion,APT32 T1070.006,Timestomp,Defense Evasion,APT38|APT29|Chimera|Kimsuky|Rocke|TEMP.Veles|APT32|Lazarus Group|APT28 T1070.005,Network Share Connection Removal,Defense Evasion,Threat Group-3390 -T1070.004,File Deletion,Defense Evasion,TeamTNT|APT39|Mustang Panda|Chimera|Evilnum|Operation Wocao|FIN6|Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Cobalt Group|Dragonfly 2.0|Honeybee|Patchwork|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|APT3|Magic Hound|Threat Group-3390|APT28|FIN10|Group5|Lazarus Group|APT18|APT29 -T1070.003,Clear Command History,Defense Evasion,TeamTNT|menuPass|APT41 +T1070.004,File Deletion,Defense Evasion,Aquatic Panda|Dragonfly|TeamTNT|APT39|Mustang Panda|Chimera|Evilnum|Operation Wocao|FIN6|Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Cobalt Group|Dragonfly 2.0|Honeybee|Patchwork|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|APT3|Magic Hound|Threat Group-3390|APT28|FIN10|Group5|Lazarus Group|APT18|APT29 +T1070.003,Clear Command History,Defense Evasion,Lazarus Group|TeamTNT|menuPass|APT41 T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,APT29 -T1550.001,Application Access Token,Defense Evasion|Lateral Movement,APT28 +T1550.001,Application Access Token,Defense Evasion|Lateral Movement,APT29|APT28 T1550.003,Pass the Ticket,Defense Evasion|Lateral Movement,APT32|BRONZE BUTLER|APT29 T1550.002,Pass the Hash,Defense Evasion|Lateral Movement,Chimera|Kimsuky|GALLIUM|APT32|Night Dragon|APT28|APT1 T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,APT29 @@ -354,14 +366,14 @@ T1548.003,Sudo and Sudo Caching,Privilege Escalation|Defense Evasion,no T1548.002,Bypass User Account Control,Privilege Escalation|Defense Evasion,Evilnum|APT37|MuddyWater|Threat Group-3390|Honeybee|Cobalt Group|BRONZE BUTLER|Patchwork|APT29 T1548.001,Setuid and Setgid,Privilege Escalation|Defense Evasion,no T1548,Abuse Elevation Control Mechanism,Privilege Escalation|Defense Evasion,no -T1136.003,Cloud Account,Persistence,no +T1136.003,Cloud Account,Persistence,APT29 T1070.002,Clear Linux or Mac System Logs,Defense Evasion,TeamTNT|Rocke -T1070.001,Clear Windows Event Logs,Defense Evasion,Indrik Spider|Chimera|Operation Wocao|APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28 +T1070.001,Clear Windows Event Logs,Defense Evasion,Dragonfly|Indrik Spider|Chimera|Operation Wocao|APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28 T1136.002,Domain Account,Persistence,Sandworm Team|HAFNIUM|GALLIUM -T1136.001,Local Account,Persistence,TeamTNT|Fox Kitten|APT39|APT41|Leafminer|Dragonfly 2.0|APT3 +T1136.001,Local Account,Persistence,Kimsuky|Dragonfly|TeamTNT|Fox Kitten|APT39|APT41|Leafminer|Dragonfly 2.0|APT3 T1547.011,Plist Modification,Persistence|Privilege Escalation,no T1547.010,Port Monitors,Persistence|Privilege Escalation,no -T1547.009,Shortcut Modification,Persistence|Privilege Escalation,APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Lazarus Group|Leviathan +T1547.009,Shortcut Modification,Persistence|Privilege Escalation,Dragonfly|APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Lazarus Group|Leviathan T1547.008,LSASS Driver,Persistence|Privilege Escalation,no T1547.007,Re-opened Applications,Persistence|Privilege Escalation,no T1547.006,Kernel Modules and Extensions,Persistence|Privilege Escalation,no @@ -385,18 +397,18 @@ T1546.004,Unix Shell Configuration Modification,Privilege Escalation|Persistence T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,FIN8|Mustang Panda|APT33|Blue Mockingbird|Turla|Leviathan|APT29 T1546.002,Screensaver,Privilege Escalation|Persistence,no T1546.001,Change Default File Association,Privilege Escalation|Persistence,Kimsuky -T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,TeamTNT|Naikon|Windshift|Mustang Panda|ZIRCONIUM|Higaisa|Sidewinder|APT28|Wizard Spider|PROMETHIUM|Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Kimsuky|APT33|APT39|APT32|APT18|Dark Caracal|Threat Group-3390|Honeybee|Turla|Cobalt Group|Ke3chang|Dragonfly 2.0|APT19|Gorgon Group|MuddyWater|APT37|Leviathan|BRONZE BUTLER|APT3|Magic Hound|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel +T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,Confucius|Dragonfly|LazyScripter|TeamTNT|Naikon|Windshift|Mustang Panda|ZIRCONIUM|Higaisa|Sidewinder|APT28|Wizard Spider|PROMETHIUM|Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Kimsuky|APT33|APT39|APT32|APT18|Dark Caracal|Threat Group-3390|Honeybee|Turla|Cobalt Group|Ke3chang|Dragonfly 2.0|APT19|Gorgon Group|MuddyWater|APT37|Leviathan|BRONZE BUTLER|APT3|Magic Hound|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel T1218.002,Control Panel,Defense Evasion,no -T1218.010,Regsvr32,Defense Evasion,TA551|Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda +T1218.010,Regsvr32,Defense Evasion,Kimsuky|Lazarus Group|TA551|Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda T1218.009,Regsvcs/Regasm,Defense Evasion,no -T1218.005,Mshta,Defense Evasion,Mustang Panda|TA551|Sidewinder|Inception|Kimsuky|APT32|MuddyWater|FIN7 +T1218.005,Mshta,Defense Evasion,Gamaredon Group|Confucius|Lazarus Group|APT29|LazyScripter|Mustang Panda|TA551|Sidewinder|Inception|Kimsuky|APT32|MuddyWater|FIN7 T1218.004,InstallUtil,Defense Evasion,Mustang Panda|menuPass -T1218.001,Compiled HTML File,Defense Evasion,APT41|Silence|Dark Caracal|OilRig|Lazarus Group +T1218.001,Compiled HTML File,Defense Evasion,APT38|APT41|Silence|Dark Caracal|OilRig|Lazarus Group T1218.003,CMSTP,Defense Evasion,Cobalt Group|MuddyWater -T1218.011,Rundll32,Defense Evasion,APT38|HAFNIUM|TA551|APT41|Gamaredon Group|APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28 +T1218.011,Rundll32,Defense Evasion,Kimsuky|Lazarus Group|LazyScripter|APT38|HAFNIUM|TA551|APT41|Gamaredon Group|APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28 T1547,Boot or Logon Autostart Execution,Persistence|Privilege Escalation,no T1546,Event Triggered Execution,Privilege Escalation|Persistence,no -T1098.003,Add Office 365 Global Administrator Role,Persistence,no +T1098.003,Add Office 365 Global Administrator Role,Persistence,APT29 T1098.002,Exchange Email Delegate Permissions,Persistence,APT28|APT29|Magic Hound T1098.001,Additional Cloud Credentials,Persistence,APT29 T1543.004,Launch Daemon,Persistence|Privilege Escalation,no @@ -405,7 +417,7 @@ T1543.002,Systemd Service,Persistence|Privilege Escalation,TeamTNT|Rocke T1543.001,Launch Agent,Persistence|Privilege Escalation,no T1037.005,Startup Items,Persistence|Privilege Escalation,no T1037.004,RC Scripts,Persistence|Privilege Escalation,no -T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Threat Group-3390|menuPass|Gorgon Group|Patchwork +T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Kimsuky|Threat Group-3390|menuPass|Gorgon Group|Patchwork T1055.013,Process Doppelgänging,Defense Evasion|Privilege Escalation,Leafminer T1055.011,Extra Window Memory Injection,Defense Evasion|Privilege Escalation,no T1055.014,VDSO Hijacking,Defense Evasion|Privilege Escalation,no @@ -423,12 +435,12 @@ T1037.001,Logon Script (Windows),Persistence|Privilege Escalation,Cobalt Group|A T1542.003,Bootkit,Persistence|Defense Evasion,APT41|Lazarus Group|APT28 T1542.002,Component Firmware,Persistence|Defense Evasion,Equation T1542.001,System Firmware,Persistence|Defense Evasion,no -T1505.003,Web Shell,Persistence,BackdoorDiplomacy|APT38|APT29|APT28|Tonto Team|Sandworm Team|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|Kimsuky|Tropic Trooper|GALLIUM|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda +T1505.003,Web Shell,Persistence,Dragonfly|BackdoorDiplomacy|APT38|APT29|APT28|Tonto Team|Sandworm Team|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|Kimsuky|Tropic Trooper|GALLIUM|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda T1505.002,Transport Agent,Persistence,no T1505.001,SQL Stored Procedures,Persistence,Sandworm Team T1053.003,Cron,Execution|Persistence|Privilege Escalation,APT38|Rocke T1053.001,At (Linux),Execution|Persistence|Privilege Escalation,no -T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,APT37|APT38|Naikon|CostaRicto|Mustang Panda|Higaisa|Fox Kitten|Molerats|Machete|Operation Wocao|Chimera|Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|GALLIUM|Silence|TEMP.Veles|APT33|APT39|Rancor|OilRig|Patchwork|Dragonfly 2.0|Cobalt Group|FIN8|menuPass|FIN10|FIN7|APT32|Stealth Falcon|FIN6|APT3|APT29 +T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,Kimsuky|Lazarus Group|Confucius|Dragonfly|APT37|APT38|Naikon|CostaRicto|Mustang Panda|Higaisa|Fox Kitten|Molerats|Machete|Operation Wocao|Chimera|Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|GALLIUM|Silence|TEMP.Veles|APT33|APT39|Rancor|OilRig|Patchwork|Dragonfly 2.0|Cobalt Group|FIN8|menuPass|FIN10|FIN7|APT32|Stealth Falcon|FIN6|APT3|APT29 T1053.002,At (Windows),Execution|Persistence|Privilege Escalation,BRONZE BUTLER|Threat Group-3390|APT18 T1542,Pre-OS Boot,Defense Evasion|Persistence,no T1137.001,Office Template Macros,Persistence,MuddyWater @@ -438,11 +450,11 @@ T1137.005,Outlook Rules,Persistence,no T1137.006,Add-ins,Persistence,Naikon T1137.002,Office Test,Persistence,APT28 T1531,Account Access Removal,Impact,no -T1539,Steal Web Session Cookie,Credential Access,Evilnum +T1539,Steal Web Session Cookie,Credential Access,APT29|Evilnum T1529,System Shutdown/Reboot,Impact,Lazarus Group|APT38|APT37 T1518,Software Discovery,Discovery,Mustang Panda|Windshift|MuddyWater|Windigo|Sidewinder|Operation Wocao|BRONZE BUTLER|Tropic Trooper|Inception T1547.013,XDG Autostart Entries,Persistence|Privilege Escalation,no -T1534,Internal Spearphishing,Lateral Movement,Leviathan|Gamaredon Group +T1534,Internal Spearphishing,Lateral Movement,Kimsuky|Lazarus Group|Leviathan|Gamaredon Group T1528,Steal Application Access Token,Credential Access,APT28 T1535,Unused/Unsupported Cloud Regions,Defense Evasion,no T1525,Implant Internal Image,Persistence,no @@ -461,42 +473,42 @@ T1491,Defacement,Impact,no T1490,Inhibit System Recovery,Impact,no T1489,Service Stop,Impact,Indrik Spider|Wizard Spider|Lazarus Group T1486,Data Encrypted for Impact,Impact,FIN7|Indrik Spider|APT41|TA505|APT38 -T1485,Data Destruction,Impact,Sandworm Team|Lazarus Group|APT38 +T1485,Data Destruction,Impact,Gamaredon Group|Sandworm Team|Lazarus Group|APT38 T1484,Domain Policy Modification,Defense Evasion|Privilege Escalation,no T1482,Domain Trust Discovery,Discovery,FIN8|APT29|Chimera T1480,Execution Guardrails,Defense Evasion,no -T1221,Template Injection,Defense Evasion,Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|DarkHydrus|Dragonfly 2.0 +T1221,Template Injection,Defense Evasion,Lazarus Group|Confucius|Dragonfly|Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|DarkHydrus|Dragonfly 2.0 T1222,File and Directory Permissions Modification,Defense Evasion,no -T1220,XSL Script Processing,Defense Evasion,Higaisa|Cobalt Group +T1220,XSL Script Processing,Defense Evasion,Lazarus Group|Higaisa|Cobalt Group T1217,Browser Bookmark Discovery,Discovery,APT38|Chimera|Fox Kitten T1212,Exploitation for Credential Access,Credential Access,no -T1189,Drive-by Compromise,Initial Access,Transparent Tribe|Andariel|Leviathan|Machete|Windigo|Dragonfly|PROMETHIUM|Turla|Windshift|RTM|Darkhotel|APT38|APT19|Lazarus Group|Threat Group-3390|BRONZE BUTLER|APT32|Dark Caracal|Dragonfly 2.0|Leafminer|Patchwork|APT37|Elderwood|PLATINUM +T1189,Drive-by Compromise,Initial Access,Magic Hound|APT28|Axiom|Transparent Tribe|Andariel|Leviathan|Machete|Windigo|Dragonfly|PROMETHIUM|Turla|Windshift|RTM|Darkhotel|APT38|APT19|Lazarus Group|Threat Group-3390|BRONZE BUTLER|APT32|Dark Caracal|Dragonfly 2.0|Leafminer|Patchwork|APT37|Elderwood|PLATINUM T1211,Exploitation for Defense Evasion,Defense Evasion,APT28 T1197,BITS Jobs,Defense Evasion|Persistence,APT39|Patchwork|APT41|Leviathan -T1203,Exploitation for Client Execution,Execution,Andariel|Transparent Tribe|APT3|Tonto Team|Mustang Panda|Darkhotel|Higaisa|HAFNIUM|Sidewinder|Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Cobalt Group|Lazarus Group|Patchwork|Elderwood|APT29|TA459|APT37|Leviathan +T1203,Exploitation for Client Execution,Execution,Axiom|Confucius|Dragonfly|Andariel|Transparent Tribe|APT3|Tonto Team|Mustang Panda|Darkhotel|Higaisa|HAFNIUM|Sidewinder|Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Cobalt Group|Lazarus Group|Patchwork|Elderwood|APT29|TA459|APT37|Leviathan T1201,Password Policy Discovery,Discovery,Chimera|Turla|OilRig T1195,Supply Chain Compromise,Initial Access,no -T1199,Trusted Relationship,Initial Access,APT29|Sandworm Team|GOLD SOUTHFIELD|APT28|menuPass -T1218,Signed Binary Proxy Execution,Defense Evasion,no +T1199,Trusted Relationship,Initial Access,Threat Group-3390|APT29|Sandworm Team|GOLD SOUTHFIELD|APT28|menuPass +T1218,Signed Binary Proxy Execution,Defense Evasion,Lazarus Group T1204,User Execution,Execution,no -T1213,Data from Information Repositories,Collection,APT28|Fox Kitten|FIN6|Turla -T1190,Exploit Public-Facing Application,Initial Access,BackdoorDiplomacy|menuPass|Volatile Cedar|Fox Kitten|Operation Wocao|APT28|APT29|GOLD SOUTHFIELD|Blue Mockingbird|Rocke|APT39|BlackTech|APT41|GALLIUM|Night Dragon|Axiom -T1210,Exploitation of Remote Services,Lateral Movement,Tonto Team|FIN7|Fox Kitten|menuPass|Wizard Spider|Threat Group-3390|APT28 +T1213,Data from Information Repositories,Collection,APT29|APT28|Fox Kitten|FIN6|Turla +T1190,Exploit Public-Facing Application,Initial Access,Threat Group-3390|Ke3chang|Kimsuky|Magic Hound|Dragonfly|BackdoorDiplomacy|menuPass|Volatile Cedar|Fox Kitten|Operation Wocao|APT28|APT29|GOLD SOUTHFIELD|Blue Mockingbird|Rocke|APT39|BlackTech|APT41|GALLIUM|Night Dragon|Axiom +T1210,Exploitation of Remote Services,Lateral Movement,Dragonfly|Tonto Team|FIN7|Fox Kitten|menuPass|Wizard Spider|Threat Group-3390|APT28 T1200,Hardware Additions,Initial Access,DarkVishnya -T1202,Indirect Command Execution,Defense Evasion,no +T1202,Indirect Command Execution,Defense Evasion,Lazarus Group T1219,Remote Access Software,Command And Control,TeamTNT|Mustang Panda|MuddyWater|Evilnum|GOLD SOUTHFIELD|Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Cobalt Group|Thrip|Carbanak T1207,Rogue Domain Controller,Defense Evasion,no T1216,Signed Script Proxy Execution,Defense Evasion,no T1205,Traffic Signaling,Defense Evasion|Persistence|Command And Control,no T1176,Browser Extensions,Persistence,Kimsuky -T1187,Forced Authentication,Credential Access,DarkHydrus|Dragonfly 2.0 +T1187,Forced Authentication,Credential Access,Dragonfly|DarkHydrus|Dragonfly 2.0 T1185,Browser Session Hijacking,Collection,no -T1140,Deobfuscate/Decode Files or Information,Defense Evasion,APT39|APT29|ZIRCONIUM|Higaisa|Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|Honeybee|Gorgon Group|Threat Group-3390|menuPass|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER +T1140,Deobfuscate/Decode Files or Information,Defense Evasion,Lazarus Group|Ke3chang|Kimsuky|APT39|APT29|ZIRCONIUM|Higaisa|Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|Honeybee|Gorgon Group|Threat Group-3390|menuPass|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,FIN6|Blue Mockingbird T1136,Create Account,Persistence,Sandworm Team|Indrik Spider -T1135,Network Share Discovery,Discovery,Tonto Team|APT38|Chimera|Operation Wocao|Wizard Spider|APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug +T1135,Network Share Discovery,Discovery,Dragonfly|Tonto Team|APT38|Chimera|Operation Wocao|Wizard Spider|APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug T1137,Office Application Startup,Persistence,Gamaredon Group|APT32 -T1133,External Remote Services,Persistence|Initial Access,TeamTNT|Leviathan|APT28|APT29|Operation Wocao|Wizard Spider|Kimsuky|GOLD SOUTHFIELD|Chimera|Sandworm Team|APT41|GALLIUM|TEMP.Veles|Night Dragon|Ke3chang|OilRig|Dragonfly 2.0|FIN5|Threat Group-3390|APT18 +T1133,External Remote Services,Persistence|Initial Access,Dragonfly|TeamTNT|Leviathan|APT28|APT29|Operation Wocao|Wizard Spider|Kimsuky|GOLD SOUTHFIELD|Chimera|Sandworm Team|APT41|GALLIUM|TEMP.Veles|Night Dragon|Ke3chang|OilRig|Dragonfly 2.0|FIN5|Threat Group-3390|APT18 T1132,Data Encoding,Command And Control,no T1129,Shared Modules,Execution,no T1127,Trusted Developer Utilities Proxy Execution,Defense Evasion,no @@ -504,64 +516,64 @@ T1125,Video Capture,Collection,Silence|FIN7 T1124,System Time Discovery,Discovery,Darkhotel|ZIRCONIUM|Higaisa|Sidewinder|Chimera|Operation Wocao|The White Company|Lazarus Group|BRONZE BUTLER|Turla T1123,Audio Capture,Collection,APT37 T1120,Peripheral Device Discovery,Discovery,OilRig|BackdoorDiplomacy|Operation Wocao|Turla|APT37|Gamaredon Group|Equation|APT28 -T1119,Automated Collection,Collection,Mustang Panda|Sidewinder|Chimera|menuPass|Operation Wocao|Gamaredon Group|Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6 +T1119,Automated Collection,Collection,Ke3chang|Confucius|Mustang Panda|Sidewinder|Chimera|menuPass|Operation Wocao|Gamaredon Group|Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6 T1115,Clipboard Data,Collection,Operation Wocao|APT39|APT38 T1114,Email Collection,Collection,Magic Hound|Silent Librarian -T1113,Screen Capture,Collection,GOLD SOUTHFIELD|Gamaredon Group|APT39|Silence|MuddyWater|Dragonfly 2.0|OilRig|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28 -T1112,Modify Registry,Defense Evasion,Operation Wocao|Kimsuky|Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Patchwork|Gorgon Group|Threat Group-3390|Dragonfly 2.0|APT19|Honeybee|FIN8 -T1111,Two-Factor Authentication Interception,Credential Access,Chimera|Operation Wocao -T1110,Brute Force,Credential Access,APT38|APT28|Fox Kitten|DarkVishnya|APT39|OilRig|FIN5|Turla -T1106,Native API,Execution,APT38|Higaisa|menuPass|Operation Wocao|Chimera|Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|APT37|Gorgon Group -T1105,Ingress Tool Transfer,Command And Control,TeamTNT|Nomadic Octopus|IndigoZebra|Andariel|BackdoorDiplomacy|Tonto Team|HAFNIUM|APT29|Ajax Security Team|Mustang Panda|Windshift|Darkhotel|ZIRCONIUM|TA551|Volatile Cedar|Indrik Spider|Evilnum|Sidewinder|Fox Kitten|Kimsuky|Operation Wocao|Chimera|Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|GALLIUM|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Gorgon Group|OilRig|Turla|Cobalt Group|Dragonfly 2.0|FIN8|PLATINUM|APT37|Elderwood|Leviathan|APT32|Magic Hound|BRONZE BUTLER|APT3|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28 -T1104,Multi-Stage Channels,Command And Control,APT41|MuddyWater|APT3 -T1102,Web Service,Command And Control,TeamTNT|FIN8|Fox Kitten|Turla|APT32|Gamaredon Group|Rocke|Inception|FIN6 -T1098,Account Manipulation,Persistence,Sandworm Team|APT3|Dragonfly 2.0|Lazarus Group +T1113,Screen Capture,Collection,Dragonfly|GOLD SOUTHFIELD|Gamaredon Group|APT39|Silence|MuddyWater|Dragonfly 2.0|OilRig|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28 +T1112,Modify Registry,Defense Evasion,Dragonfly|Operation Wocao|Kimsuky|Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Patchwork|Gorgon Group|Threat Group-3390|Dragonfly 2.0|APT19|Honeybee|FIN8 +T1111,Two-Factor Authentication Interception,Credential Access,Kimsuky|Chimera|Operation Wocao +T1110,Brute Force,Credential Access,Lazarus Group|Dragonfly|APT38|APT28|Fox Kitten|DarkVishnya|APT39|OilRig|FIN5|Turla +T1106,Native API,Execution,BlackTech|Lazarus Group|APT38|Higaisa|menuPass|Operation Wocao|Chimera|Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|APT37|Gorgon Group +T1105,Ingress Tool Transfer,Command And Control,LazyScripter|Ke3chang|Aquatic Panda|Winnti Group|Confucius|Dragonfly|TeamTNT|Nomadic Octopus|IndigoZebra|Andariel|BackdoorDiplomacy|Tonto Team|HAFNIUM|APT29|Ajax Security Team|Mustang Panda|Windshift|Darkhotel|ZIRCONIUM|TA551|Volatile Cedar|Indrik Spider|Evilnum|Sidewinder|Fox Kitten|Kimsuky|Operation Wocao|Chimera|Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|GALLIUM|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Gorgon Group|OilRig|Turla|Cobalt Group|Dragonfly 2.0|FIN8|PLATINUM|APT37|Elderwood|Leviathan|APT32|Magic Hound|BRONZE BUTLER|APT3|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28 +T1104,Multi-Stage Channels,Command And Control,Lazarus Group|APT41|MuddyWater|APT3 +T1102,Web Service,Command And Control,Mustang Panda|LazyScripter|TeamTNT|FIN8|Fox Kitten|Turla|APT32|Gamaredon Group|Rocke|Inception|FIN6 +T1098,Account Manipulation,Persistence,Kimsuky|Dragonfly|Sandworm Team|APT3|Dragonfly 2.0|Lazarus Group T1095,Non-Application Layer Protocol,Command And Control,BackdoorDiplomacy|HAFNIUM|Operation Wocao|FIN6|APT29|PLATINUM|APT3 T1092,Communication Through Removable Media,Command And Control,APT28 -T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Mustang Panda|Tropic Trooper|Darkhotel|APT28 +T1091,Replication Through Removable Media,Lateral Movement|Initial Access,FIN7|Mustang Panda|Tropic Trooper|Darkhotel|APT28 T1090,Proxy,Command And Control,Windigo|Fox Kitten|Operation Wocao|Sandworm Team|Blue Mockingbird|APT41|Turla T1087,Account Discovery,Discovery,APT29 -T1083,File and Directory Discovery,Discovery,APT38|APT29|Mustang Panda|Darkhotel|Windigo|Sidewinder|Chimera|Fox Kitten|menuPass|APT39|Sandworm Team|Operation Wocao|Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dark Caracal|Dragonfly 2.0|APT3|Sowbug|Magic Hound|BRONZE BUTLER|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang -T1082,System Information Discovery,Discovery,TeamTNT|APT38|APT29|Mustang Panda|Windshift|ZIRCONIUM|Higaisa|Windigo|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|APT32|APT37|Honeybee|APT19|Magic Hound|Sowbug|OilRig|APT3|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang +T1083,File and Directory Discovery,Discovery,Winnti Group|Confucius|Dragonfly|APT38|APT29|Mustang Panda|Darkhotel|Windigo|Sidewinder|Chimera|Fox Kitten|menuPass|APT39|Sandworm Team|Operation Wocao|Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dark Caracal|Dragonfly 2.0|APT3|Sowbug|Magic Hound|BRONZE BUTLER|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang +T1082,System Information Discovery,Discovery,Aquatic Panda|Confucius|TeamTNT|APT38|APT29|Mustang Panda|Windshift|ZIRCONIUM|Higaisa|Windigo|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|APT32|APT37|Honeybee|APT19|Magic Hound|Sowbug|OilRig|APT3|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang T1080,Taint Shared Content,Lateral Movement,Gamaredon Group|BRONZE BUTLER|Darkhotel -T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,FIN7|Leviathan|APT29|Silent Librarian|Fox Kitten|Operation Wocao|Chimera|Sandworm Team|Wizard Spider|Silence|APT41|GALLIUM|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|APT33|FIN5|OilRig|APT28|menuPass|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak +T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Ke3chang|Lazarus Group|Axiom|Dragonfly|FIN7|Leviathan|APT29|Silent Librarian|Fox Kitten|Operation Wocao|Chimera|Sandworm Team|Wizard Spider|Silence|APT41|GALLIUM|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|APT33|FIN5|OilRig|APT28|menuPass|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak T1074,Data Staged,Collection,Wizard Spider T1072,Software Deployment Tools,Execution|Lateral Movement,Silence|APT32|Threat Group-1314 -T1071,Application Layer Protocol,Command And Control,TeamTNT|Rocke|Magic Hound|Dragonfly 2.0 -T1070,Indicator Removal on Host,Defense Evasion,APT29 +T1071,Application Layer Protocol,Command And Control,Dragonfly|TeamTNT|Rocke|Magic Hound|Dragonfly 2.0 +T1070,Indicator Removal on Host,Defense Evasion,Lazarus Group|APT29 T1069,Permission Groups Discovery,Discovery,APT29|TA505|APT3 -T1068,Exploitation for Privilege Escalation,Privilege Escalation,Tonto Team|ZIRCONIUM|Turla|Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28 -T1059,Command and Scripting Interpreter,Execution,APT37|Windigo|Fox Kitten|APT32|Whitefly|APT39|Dragonfly 2.0|FIN7|APT19|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang -T1057,Process Discovery,Discovery,TeamTNT|Andariel|APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|Chimera|Operation Wocao|Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang +T1068,Exploitation for Privilege Escalation,Privilege Escalation,APT29|Tonto Team|ZIRCONIUM|Turla|Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28 +T1059,Command and Scripting Interpreter,Execution,Dragonfly|APT37|Windigo|Fox Kitten|APT32|Whitefly|APT39|Dragonfly 2.0|FIN7|APT19|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang +T1057,Process Discovery,Discovery,Gamaredon Group|Kimsuky|TeamTNT|Andariel|APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|Chimera|Operation Wocao|Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang T1056,Input Capture,Collection|Credential Access,APT39 T1055,Process Injection,Defense Evasion|Privilege Escalation,Operation Wocao|APT32|Sharpshooter|Silence|APT41|Kimsuky|Cobalt Group|Turla|APT37|Honeybee|PLATINUM T1053,Scheduled Task/Job,Execution|Persistence|Privilege Escalation,no T1052,Exfiltration Over Physical Medium,Exfiltration,no -T1049,System Network Connections Discovery,Discovery,TeamTNT|Andariel|BackdoorDiplomacy|Mustang Panda|MuddyWater|Chimera|Sandworm Team|Operation Wocao|Tropic Trooper|APT41|APT38|GALLIUM|APT32|APT1|OilRig|APT3|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang +T1049,System Network Connections Discovery,Discovery,Lazarus Group|TeamTNT|Andariel|BackdoorDiplomacy|Mustang Panda|MuddyWater|Chimera|Sandworm Team|Operation Wocao|Tropic Trooper|APT41|APT38|GALLIUM|APT32|APT1|OilRig|APT3|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang T1048,Exfiltration Over Alternative Protocol,Exfiltration,no -T1047,Windows Management Instrumentation,Execution,Sandworm Team|FIN7|Indrik Spider|Naikon|Mustang Panda|Windshift|Operation Wocao|Chimera|Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|GALLIUM|APT32|MuddyWater|Threat Group-3390|OilRig|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda -T1046,Network Service Scanning,Discovery,TeamTNT|BackdoorDiplomacy|Naikon|CostaRicto|Chimera|Fox Kitten|Operation Wocao|Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|OilRig|Cobalt Group|Leafminer|menuPass|Suckfly|FIN6|Threat Group-3390 -T1041,Exfiltration Over C2 Channel,Exfiltration,Leviathan|ZIRCONIUM|Higaisa|Chimera|APT39|Operation Wocao|Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|GALLIUM|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang +T1047,Windows Management Instrumentation,Execution,Gamaredon Group|Sandworm Team|FIN7|Indrik Spider|Naikon|Mustang Panda|Windshift|Operation Wocao|Chimera|Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|GALLIUM|APT32|MuddyWater|Threat Group-3390|OilRig|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda +T1046,Network Service Scanning,Discovery,BlackTech|Lazarus Group|TeamTNT|BackdoorDiplomacy|Naikon|CostaRicto|Chimera|Fox Kitten|Operation Wocao|Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|OilRig|Cobalt Group|Leafminer|menuPass|Suckfly|FIN6|Threat Group-3390 +T1041,Exfiltration Over C2 Channel,Exfiltration,Confucius|Leviathan|ZIRCONIUM|Higaisa|Chimera|APT39|Operation Wocao|Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|GALLIUM|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang T1040,Network Sniffing,Credential Access|Discovery,Kimsuky|Sandworm Team|DarkVishnya|APT33|APT28 T1039,Data from Network Shared Drive,Collection,APT28|Chimera|Fox Kitten|Gamaredon Group|BRONZE BUTLER|Sowbug|menuPass T1037,Boot or Logon Initialization Scripts,Persistence|Privilege Escalation,Rocke -T1036,Masquerading,Defense Evasion,APT28|Nomadic Octopus|OilRig|APT29|ZIRCONIUM|TA551|Windshift|APT32|BRONZE BUTLER|menuPass|PLATINUM|Dragonfly 2.0 -T1033,System Owner/User Discovery,Discovery,APT38|Windshift|ZIRCONIUM|Sidewinder|Chimera|Sandworm Team|Operation Wocao|Wizard Spider|Frankenstein|APT41|GALLIUM|Tropic Trooper|APT39|MuddyWater|APT37|Dragonfly 2.0|APT19|APT32|Magic Hound|OilRig|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3 +T1036,Masquerading,Defense Evasion,Kimsuky|Lazarus Group|Dragonfly|LazyScripter|APT28|Nomadic Octopus|OilRig|APT29|ZIRCONIUM|TA551|Windshift|APT32|BRONZE BUTLER|menuPass|PLATINUM|Dragonfly 2.0 +T1033,System Owner/User Discovery,Discovery,Threat Group-3390|Ke3chang|Dragonfly|APT38|Windshift|ZIRCONIUM|Sidewinder|Chimera|Sandworm Team|Operation Wocao|Wizard Spider|Frankenstein|APT41|GALLIUM|Tropic Trooper|APT39|MuddyWater|APT37|Dragonfly 2.0|APT19|APT32|Magic Hound|OilRig|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3 T1030,Data Transfer Size Limits,Exfiltration,APT28|Threat Group-3390 T1029,Scheduled Transfer,Exfiltration,Higaisa -T1027,Obfuscated Files or Information,Defense Evasion,TeamTNT|BackdoorDiplomacy|Transparent Tribe|APT39|Mustang Panda|Windshift|TA551|Higaisa|Sidewinder|Fox Kitten|GOLD SOUTHFIELD|Operation Wocao|Kimsuky|FIN6|Chimera|Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|GALLIUM|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Patchwork|menuPass|APT37|Threat Group-3390|Cobalt Group|Dark Caracal|Leafminer|Honeybee|APT19|BlackOasis|Leviathan|FIN8|MuddyWater|FIN7|Elderwood|OilRig|Magic Hound|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28 +T1027,Obfuscated Files or Information,Defense Evasion,Aquatic Panda|Ke3chang|LazyScripter|TeamTNT|BackdoorDiplomacy|Transparent Tribe|APT39|Mustang Panda|Windshift|TA551|Higaisa|Sidewinder|Fox Kitten|GOLD SOUTHFIELD|Operation Wocao|Kimsuky|FIN6|Chimera|Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|GALLIUM|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Patchwork|menuPass|APT37|Threat Group-3390|Cobalt Group|Dark Caracal|Leafminer|Honeybee|APT19|BlackOasis|Leviathan|FIN8|MuddyWater|FIN7|Elderwood|OilRig|Magic Hound|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28 T1025,Data from Removable Media,Collection,Turla|Gamaredon Group|APT28 T1021,Remote Services,Lateral Movement,no -T1020,Automated Exfiltration,Exfiltration,Sidewinder|Gamaredon Group|Tropic Trooper|Frankenstein|Honeybee -T1018,Remote System Discovery,Discovery,Indrik Spider|Naikon|APT29|Chimera|Fox Kitten|Operation Wocao|Sandworm Team|Rocke|Wizard Spider|Silence|GALLIUM|APT39|APT32|Deep Panda|Ke3chang|Threat Group-3390|Dragonfly 2.0|Leafminer|FIN8|FIN5|APT3|BRONZE BUTLER|menuPass|FIN6|Turla -T1016,System Network Configuration Discovery,Discovery,TeamTNT|ZIRCONIUM|Mustang Panda|Higaisa|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Sandworm Team|Tropic Trooper|Frankenstein|APT41|GALLIUM|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|Magic Hound|OilRig|Threat Group-3390|menuPass|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang +T1020,Automated Exfiltration,Exfiltration,Ke3chang|Sidewinder|Gamaredon Group|Tropic Trooper|Frankenstein|Honeybee +T1018,Remote System Discovery,Discovery,Dragonfly|Indrik Spider|Naikon|APT29|Chimera|Fox Kitten|Operation Wocao|Sandworm Team|Rocke|Wizard Spider|Silence|GALLIUM|APT39|APT32|Deep Panda|Ke3chang|Threat Group-3390|Dragonfly 2.0|Leafminer|FIN8|FIN5|APT3|BRONZE BUTLER|menuPass|FIN6|Turla +T1016,System Network Configuration Discovery,Discovery,Kimsuky|Dragonfly|TeamTNT|ZIRCONIUM|Mustang Panda|Higaisa|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Sandworm Team|Tropic Trooper|Frankenstein|APT41|GALLIUM|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|Magic Hound|OilRig|Threat Group-3390|menuPass|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang T1014,Rootkit,Defense Evasion,TeamTNT|Rocke|APT41|APT28|Winnti Group -T1012,Query Registry,Discovery,ZIRCONIUM|Chimera|Fox Kitten|APT39|Operation Wocao|APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla +T1012,Query Registry,Discovery,Kimsuky|Dragonfly|ZIRCONIUM|Chimera|Fox Kitten|APT39|Operation Wocao|APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla T1011,Exfiltration Over Other Network Medium,Exfiltration,no T1010,Application Window Discovery,Discovery,Lazarus Group T1008,Fallback Channels,Command And Control,FIN7|APT41|OilRig|Lazarus Group -T1007,System Service Discovery,Discovery,Indrik Spider|Chimera|Operation Wocao|BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang +T1007,System Service Discovery,Discovery,Kimsuky|Aquatic Panda|Indrik Spider|Chimera|Operation Wocao|BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang T1006,Direct Volume Access,Defense Evasion,no -T1005,Data from Local System,Collection,FIN7|APT41|APT38|Andariel|APT29|Windigo|Fox Kitten|Sandworm Team|Operation Wocao|FIN6|Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|GALLIUM|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang +T1005,Data from Local System,Collection,Axiom|Dragonfly|FIN7|APT41|APT38|Andariel|APT29|Windigo|Fox Kitten|Sandworm Team|Operation Wocao|FIN6|Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|GALLIUM|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang T1003,OS Credential Dumping,Credential Access,Tonto Team|APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom T1001,Data Obfuscation,Command And Control,Operation Wocao|Axiom diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json index eea7157980..3598427247 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json @@ -1 +1 @@ -{"detections": [{"name": "Attempted Credential Dump From Registry via Reg exe", "id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911", "version": 6, "date": "2021-09-16", "author": "Patrick Bareiss, Splunk", "type": "TTP", "datamodel": ["Endpoint"], "description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.", "search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`", "how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.", "known_false_positives": "None identified.", "references": ["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets"], "tags": {"name": "Attempted Credential Dump From Registry via Reg exe", "analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "asset_type": "Endpoint", "automated_detection_testing": "passed", "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "dataset": ["https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.", "mitre_attack_id": ["T1003.002", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "type": "User", "role": ["Victim"]}, {"name": "dest", "type": "Hostname", "role": ["Victim"]}, {"name": "parent_process_name", "type": "Process", "role": ["Parent Process"]}, {"name": "process_name", "type": "Process", "role": ["Child Process"]}], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Processes.dest", "Processes.user", "Processes.parent_process_name", "Processes.parent_process", "Processes.original_file_name", "Processes.process_name", "Processes.process", "Processes.process_id", "Processes.parent_process_path", "Processes.process_path", "Processes.parent_process_id"], "risk_score": 90, "security_domain": "endpoint", "risk_severity": "high", "supported_tas": ["Splunk_TA_microsoft_sysmon"], "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "Dragonfly 2.0", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}]}, "macros": [{"name": "process_reg", "definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"}, {"name": "attempted_credential_dump_from_registry_via_reg_exe_filter", "definition": "search *", "description": "Update this macro to limit the output results to filter out false positives."}], "lookups": [], "cve_enrichment": [], "splunk_app_enrichment": [{"name": "Splunk Add-on for Sysmon", "url": "https://splunkbase.splunk.com/app/5709"}], "file_path": "/Users/lstella/ThreatResearch/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml", "source": "detection"}]} \ No newline at end of file +{"detections": [{"name": "Attempted Credential Dump From Registry via Reg exe", "id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911", "version": 6, "date": "2021-09-16", "author": "Patrick Bareiss, Splunk", "type": "TTP", "datamodel": ["Endpoint"], "description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.", "search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`", "how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.", "known_false_positives": "None identified.", "references": ["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets"], "tags": {"name": "Attempted Credential Dump From Registry via Reg exe", "analytic_story": ["Credential Dumping", "DarkSide Ransomware"], "asset_type": "Endpoint", "automated_detection_testing": "passed", "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "dataset": ["https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.", "mitre_attack_id": ["T1003.002", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "type": "User", "role": ["Victim"]}, {"name": "dest", "type": "Hostname", "role": ["Victim"]}, {"name": "parent_process_name", "type": "Process", "role": ["Parent Process"]}, {"name": "process_name", "type": "Process", "role": ["Child Process"]}], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "required_fields": ["_time", "Processes.dest", "Processes.user", "Processes.parent_process_name", "Processes.parent_process", "Processes.original_file_name", "Processes.process_name", "Processes.process", "Processes.process_id", "Processes.parent_process_path", "Processes.process_path", "Processes.parent_process_id"], "risk_score": 90, "security_domain": "endpoint", "risk_severity": "high", "supported_tas": ["Splunk_TA_microsoft_sysmon"], "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}]}, "macros": [{"name": "process_reg", "definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"}, {"name": "attempted_credential_dump_from_registry_via_reg_exe_filter", "definition": "search *", "description": "Update this macro to limit the output results to filter out false positives."}], "lookups": [], "cve_enrichment": [], "splunk_app_enrichment": [{"name": "Splunk Add-on for Sysmon", "url": "https://splunkbase.splunk.com/app/5709"}], "file_path": "/home/jhernandez/splunk/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml", "source": "detection"}]} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json index 32eae4074f..b3c6439f68 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json @@ -1 +1 @@ -{"stories": [{"name": "DarkSide Ransomware", "id": "507edc74-13d5-4339-878e-b9114ded1f35", "version": 1, "date": "2021-05-12", "author": "Bhavin Patel, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware", "narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.", "references": ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"], "tags": {"name": "DarkSide Ransomware", "analytic_story": "DarkSide Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "Dragonfly 2.0", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}], "mitre_attack_tactics": ["Credential Access"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule"], "investigation_names": ["ESCU - Get Parent Process Info - Response Task"], "baseline_names": ["ESCU - Baseline Of Cloud Instances Launched"], "author_company": "Splunk", "author_name": "Bhavin Patel"}]} \ No newline at end of file +{"stories": [{"name": "DarkSide Ransomware", "id": "507edc74-13d5-4339-878e-b9114ded1f35", "version": 1, "date": "2021-05-12", "author": "Bhavin Patel, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware", "narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.", "references": ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"], "tags": {"name": "DarkSide Ransomware", "analytic_story": "DarkSide Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}], "mitre_attack_tactics": ["Credential Access"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule"], "investigation_names": ["ESCU - Get Parent Process Info - Response Task"], "baseline_names": ["ESCU - Baseline Of Cloud Instances Launched"], "author_company": "Splunk", "author_name": "Bhavin Patel"}]} \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_posts/2020-07-21-detect_new_user_aws_console_login.md b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_posts/2020-07-21-detect_new_user_aws_console_login.md index daf6babc29..d0abbe04c2 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_posts/2020-07-21-detect_new_user_aws_console_login.md +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_posts/2020-07-21-detect_new_user_aws_console_login.md @@ -96,7 +96,7 @@ This search looks for AWS CloudTrail events wherein a console login event by a u -#### Search +#### Search ``` `cloudtrail` eventName=ConsoleLogin @@ -114,7 +114,8 @@ This search looks for AWS CloudTrail events wherein a console login event by a u #### Macros The SPL above uses the following Macros: -Note that **detect_new_user_aws_console_login_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **detect_new_user_aws_console_login_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,6 +142,9 @@ When a legitimate new user logins for the first time, this activity will be dete | 90.0 | 90 | 100 | tbd | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + #### Reference diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md index 6d22e9f464..2e526fc18b 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md @@ -100,7 +100,7 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th -#### Search +#### Search ``` @@ -114,7 +114,8 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th #### Macros The SPL above uses the following Macros: -Note that **attempted_credential_dump_from_registry_via_reg_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +> :information_source: +> **attempted_credential_dump_from_registry_via_reg_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,6 +152,9 @@ None identified. | 90.0 | 90 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys. | +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + #### Reference * [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets) diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2020-07-21-detect_new_user_aws_console_login.md b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2020-07-21-detect_new_user_aws_console_login.md index 5a3a944eb6..d0abbe04c2 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2020-07-21-detect_new_user_aws_console_login.md +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2020-07-21-detect_new_user_aws_console_login.md @@ -26,7 +26,7 @@ tags: This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour. Deprecated now this search is updated to use the Authentication datamodel. -- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Last Updated**: 2020-07-21 @@ -113,8 +113,6 @@ This search looks for AWS CloudTrail events wherein a console login event by a u #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **detect_new_user_aws_console_login_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -141,11 +139,11 @@ When a legitimate new user logins for the first time, this activity will be dete | Risk Score | Impact | Confidence | Message | | ----------- | ----------- |--------------|--------------| -| 25.0 | 50 | 50 | tbd | +| 90.0 | 90 | 100 | tbd | > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md index 0ce7794c62..2e526fc18b 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md @@ -4,7 +4,7 @@ excerpt: "Security Account Manager , OS Credential Dumping " categories: - - Endpoint + - Detection last_modified_at: 2021-09-16 toc: true toc_label: "" @@ -113,10 +113,6 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) > :information_source: > **attempted_credential_dump_from_registry_via_reg_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -145,8 +141,6 @@ None identified. #### Associated Analytic story * [Credential Dumping](/stories/credential_dumping) * [DarkSide Ransomware](/stories/darkside_ransomware) -* [Windows Registry Abuse](/stories/windows_registry_abuse) -* [Industroyer2](/stories/industroyer2) @@ -159,7 +153,7 @@ None identified. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference @@ -176,4 +170,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith -[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml) \| *version*: **6** \ No newline at end of file +[*source*](https://github.com/splunk/security_content/tree/develop/detections/detection/attempted_credential_dump_from_registry_via_reg_exe.yml) \| *version*: **6** \ No newline at end of file diff --git a/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md b/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md index 9dc55bf436..d284f074ec 100644 --- a/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md +++ b/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md @@ -136,7 +136,7 @@ It is possible that your vulnerability scanner is not detecting that the patches > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md index 4d77ce3131..ec79fde91f 100644 --- a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md +++ b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md @@ -137,7 +137,7 @@ Legitimate router connections may appear as new connections > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md b/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md index 2e5dcb136e..64449b47a3 100644 --- a/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md +++ b/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md @@ -99,8 +99,8 @@ This search returns a list of hosts that have not successfully completed a backu #### Macros The SPL above uses the following Macros: -* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml) > :information_source: > **extended_period_without_successful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -131,7 +131,7 @@ None identified > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2017-09-12-identify_new_user_accounts.md b/docs/_posts/2017-09-12-identify_new_user_accounts.md index 34f43c8fec..2db91f8f64 100644 --- a/docs/_posts/2017-09-12-identify_new_user_accounts.md +++ b/docs/_posts/2017-09-12-identify_new_user_accounts.md @@ -139,7 +139,7 @@ If the Identity_Management data model is not updated regularly, this search coul > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md b/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md index bfdc420f58..14cc93f2cc 100644 --- a/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md +++ b/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md @@ -98,8 +98,8 @@ This search gives you the hosts where a backup was attempted and then failed. #### Macros The SPL above uses the following Macros: -* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml) > :information_source: > **unsuccessful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -128,7 +128,7 @@ None identified > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md index 046f43a870..bb944d4ef6 100644 --- a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md +++ b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md @@ -139,7 +139,7 @@ This search might be prone to high false positives. Please consider this when co > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md index 0c61516252..fe4ce2296c 100644 --- a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md +++ b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md @@ -139,7 +139,7 @@ None identified > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md index ded38404ae..d522844132 100644 --- a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md +++ b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md @@ -142,7 +142,7 @@ None at this time > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2017-09-19-open_redirect_in_splunk_web.md b/docs/_posts/2017-09-19-open_redirect_in_splunk_web.md index 26e58dd350..45c130424f 100644 --- a/docs/_posts/2017-09-19-open_redirect_in_splunk_web.md +++ b/docs/_posts/2017-09-19-open_redirect_in_splunk_web.md @@ -133,7 +133,7 @@ None identified > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md index 9ecc7eda5b..0c3e2400b8 100644 --- a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md +++ b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md @@ -147,7 +147,7 @@ Legitimate ANY requests may trigger this search, however it is unusual to see a > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md index 6e77e339c2..410a212365 100644 --- a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md @@ -139,7 +139,7 @@ It's possible for legitimate HTTP requests to be made to URLs containing the sus > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md index b7f1c3032e..421516f284 100644 --- a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md @@ -145,7 +145,7 @@ No known false positives for this detection. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md index dd69d086cf..351df8d65f 100644 --- a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md @@ -95,9 +95,9 @@ This search looks for DNS requests for faux domains similar to the domains that #### Macros The SPL above uses the following Macros: +* [brand_abuse_dns](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_dns.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [brand_abuse_dns](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_dns.yml) > :information_source: > **monitor_dns_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -126,7 +126,7 @@ None at this time > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md index 3f11380515..4457943a64 100644 --- a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md @@ -101,8 +101,8 @@ This search looks for Web requests to faux domains similar to the one that you w #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml) > :information_source: > **monitor_web_traffic_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -133,7 +133,7 @@ None at this time > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2017-10-13-unusually_long_content-type_length.md b/docs/_posts/2017-10-13-unusually_long_content-type_length.md index 4c03057b2b..022670955d 100644 --- a/docs/_posts/2017-10-13-unusually_long_content-type_length.md +++ b/docs/_posts/2017-10-13-unusually_long_content-type_length.md @@ -141,7 +141,7 @@ Very few legitimate Content-Type fields will have a length greater than 100 char > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2017-11-27-detect_usb_device_insertion.md b/docs/_posts/2017-11-27-detect_usb_device_insertion.md index 7a0d809cf9..d728677662 100644 --- a/docs/_posts/2017-11-27-detect_usb_device_insertion.md +++ b/docs/_posts/2017-11-27-detect_usb_device_insertion.md @@ -134,7 +134,7 @@ Legitimate USB activity will also be detected. Please verify and investigate as > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md index 4dace7f9d7..bfdf6ece90 100644 --- a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md +++ b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md @@ -144,7 +144,7 @@ None at this time > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md b/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md index 0998e6e218..256ee9687b 100644 --- a/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md +++ b/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md @@ -110,8 +110,8 @@ This search looks for AWS CloudTrail events where an instance is started in a pa #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **ec2_instance_started_in_previously_unseen_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -142,7 +142,7 @@ It's possible that a user has unknowingly started an instance in a new region. P > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md b/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md index bd0d436951..a7a3e55b1d 100644 --- a/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md +++ b/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md @@ -106,8 +106,8 @@ This search looks for EC2 instances being created with previously unseen AMIs. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **ec2_instance_started_with_previously_unseen_ami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -139,7 +139,7 @@ After a new AMI is created, the first systems created with that AMI will cause t > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_city.md b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_city.md index 97754107f3..3549d32c1a 100644 --- a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_city.md +++ b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_city.md @@ -148,7 +148,7 @@ This is a strictly behavioral search, so we define "false positive" slightly dif > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_country.md b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_country.md index ef8a7cc9fe..df3f85325a 100644 --- a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_country.md +++ b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_country.md @@ -148,7 +148,7 @@ This is a strictly behavioral search, so we define "false positive" slightly dif > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_ip_address.md b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_ip_address.md index 11f4920b3b..de6d30f26d 100644 --- a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_ip_address.md +++ b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_ip_address.md @@ -138,7 +138,7 @@ This is a strictly behavioral search, so we define "false positive" slightly dif > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_region.md b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_region.md index 3fdfd56205..c208be78bb 100644 --- a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_region.md +++ b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_region.md @@ -148,7 +148,7 @@ This is a strictly behavioral search, so we define "false positive" slightly dif > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md b/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md index e1c053b02c..5d9fec816d 100644 --- a/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md +++ b/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md @@ -117,8 +117,8 @@ This search detects new API calls that have either never been seen before or tha #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_new_api_calls_from_user_roles_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -157,7 +157,7 @@ It is possible that there are legitimate user roles making new or infrequently u > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md index 72d96888b4..bbb21c3187 100644 --- a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md +++ b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md @@ -161,7 +161,7 @@ Based on the values of`dataPointThreshold` and `deviationThreshold`, the false p > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md index 735784bf2f..b7091dac1a 100644 --- a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md +++ b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md @@ -153,7 +153,7 @@ The false-positive rate may vary based on the values of`dataPointThreshold` and > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md b/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md index 41584feb4e..cfa1600f09 100644 --- a/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md +++ b/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md @@ -101,8 +101,8 @@ This search looks for AWS CloudTrail events where a user logged into the AWS acc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_api_activity_from_users_without_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -147,7 +147,7 @@ Many service accounts configured within an AWS infrastructure do not have multi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md b/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md index 4fb2b09c54..c5f5fd575e 100644 --- a/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md +++ b/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md @@ -159,7 +159,7 @@ The false-positive rate may vary based on the values of`dataPointThreshold` and > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md index 84066b6ce9..638971b92a 100644 --- a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md +++ b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md @@ -147,7 +147,7 @@ ICMP packets are used in a variety of ways to help troubleshoot networking issue > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-06-14-splunk_enterprise_information_disclosure.md b/docs/_posts/2018-06-14-splunk_enterprise_information_disclosure.md index 216b51191a..8f627c8fea 100644 --- a/docs/_posts/2018-06-14-splunk_enterprise_information_disclosure.md +++ b/docs/_posts/2018-06-14-splunk_enterprise_information_disclosure.md @@ -139,7 +139,7 @@ Retrieving server information may be a legitimate API request. Verify that the a > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md index d99e72cce4..f4a348e37c 100644 --- a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md +++ b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md @@ -118,8 +118,8 @@ This search looks at S3 bucket-access logs and detects new or previously unseen #### Macros The SPL above uses the following Macros: -* [aws_s3_accesslogs](https://github.com/splunk/security_content/blob/develop/macros/aws_s3_accesslogs.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [aws_s3_accesslogs](https://github.com/splunk/security_content/blob/develop/macros/aws_s3_accesslogs.yml) > :information_source: > **detect_s3_access_from_a_new_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -151,7 +151,7 @@ S3 buckets can be accessed from any IP, as long as it can make a successful conn > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-10-08-web_fraud_-_account_harvesting.md b/docs/_posts/2018-10-08-web_fraud_-_account_harvesting.md index b5c9a2fccf..a344e32104 100644 --- a/docs/_posts/2018-10-08-web_fraud_-_account_harvesting.md +++ b/docs/_posts/2018-10-08-web_fraud_-_account_harvesting.md @@ -141,7 +141,7 @@ As is common with many fraud-related searches, we are usually looking to attribu > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-10-08-web_fraud_-_anomalous_user_clickspeed.md b/docs/_posts/2018-10-08-web_fraud_-_anomalous_user_clickspeed.md index b3d33ca219..2574e71e9f 100644 --- a/docs/_posts/2018-10-08-web_fraud_-_anomalous_user_clickspeed.md +++ b/docs/_posts/2018-10-08-web_fraud_-_anomalous_user_clickspeed.md @@ -141,7 +141,7 @@ As is common with many fraud-related searches, we are usually looking to attribu > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-10-08-web_fraud_-_password_sharing_across_accounts.md b/docs/_posts/2018-10-08-web_fraud_-_password_sharing_across_accounts.md index 04c1965c45..5518f2b34e 100644 --- a/docs/_posts/2018-10-08-web_fraud_-_password_sharing_across_accounts.md +++ b/docs/_posts/2018-10-08-web_fraud_-_password_sharing_across_accounts.md @@ -130,7 +130,7 @@ As is common with many fraud-related searches, we are usually looking to attribu > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md b/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md index 95a541b095..689349d50f 100644 --- a/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md +++ b/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md @@ -143,7 +143,7 @@ After a new image is created, the first systems created with that image will cau > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md index 4ffc4b8799..5604b56488 100644 --- a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md @@ -148,7 +148,7 @@ Although unlikely, administrators may use event subscriptions for legitimate pur > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md index fd90259c62..71d6f444e4 100644 --- a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md @@ -146,7 +146,7 @@ Some software may create WMI temporary event subscriptions for various purposes. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-11-02-windows_hosts_file_modification.md b/docs/_posts/2018-11-02-windows_hosts_file_modification.md index 6d10464fa3..a4d2ecf6d7 100644 --- a/docs/_posts/2018-11-02-windows_hosts_file_modification.md +++ b/docs/_posts/2018-11-02-windows_hosts_file_modification.md @@ -134,7 +134,7 @@ There may be legitimate reasons for system administrators to add entries to this > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md index eb46bfa48a..4a5b791d4c 100644 --- a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md +++ b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md @@ -161,7 +161,7 @@ Based on the values of`dataPointThreshold` and `deviationThreshold`, the false p > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md index 9c4607f3dc..cc8964e565 100644 --- a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md +++ b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md @@ -110,9 +110,9 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) > :information_source: > **remote_wmi_command_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -149,7 +149,7 @@ Administrators may use this legitimately to gather info from remote systems. Fil > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-12-03-usn_journal_deletion.md b/docs/_posts/2018-12-03-usn_journal_deletion.md index 6d85fb0f21..c7193842d3 100644 --- a/docs/_posts/2018-12-03-usn_journal_deletion.md +++ b/docs/_posts/2018-12-03-usn_journal_deletion.md @@ -150,7 +150,7 @@ None identified > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-12-06-suspicious_java_classes.md b/docs/_posts/2018-12-06-suspicious_java_classes.md index 8bc58e37c6..3e1d527e90 100644 --- a/docs/_posts/2018-12-06-suspicious_java_classes.md +++ b/docs/_posts/2018-12-06-suspicious_java_classes.md @@ -140,7 +140,7 @@ There are no known false positives. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-12-14-file_with_samsam_extension.md b/docs/_posts/2018-12-14-file_with_samsam_extension.md index 48a9377b10..92a288413c 100644 --- a/docs/_posts/2018-12-14-file_with_samsam_extension.md +++ b/docs/_posts/2018-12-14-file_with_samsam_extension.md @@ -135,7 +135,7 @@ Because these extensions are not typically used in normal operations, you should > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2018-12-14-samsam_test_file_write.md b/docs/_posts/2018-12-14-samsam_test_file_write.md index 73f64823dc..57b1aa725c 100644 --- a/docs/_posts/2018-12-14-samsam_test_file_write.md +++ b/docs/_posts/2018-12-14-samsam_test_file_write.md @@ -141,7 +141,7 @@ No false positives have been identified. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md index fca4d99e35..9b822ee34d 100644 --- a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md +++ b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md @@ -135,7 +135,7 @@ There might be some false positives as keyboard event taps are used by processes > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2019-01-29-osquery_pack_-_coldroot_detection.md b/docs/_posts/2019-01-29-osquery_pack_-_coldroot_detection.md index 294d6615ee..ac2903d714 100644 --- a/docs/_posts/2019-01-29-osquery_pack_-_coldroot_detection.md +++ b/docs/_posts/2019-01-29-osquery_pack_-_coldroot_detection.md @@ -130,7 +130,7 @@ There are no known false positives. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md b/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md index 7e56579146..47ee78a2f2 100644 --- a/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md +++ b/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md @@ -147,7 +147,7 @@ The activity may be legitimate. PowerShell is often used by administrators to pe > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md b/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md index 2958197b58..48fbc32d63 100644 --- a/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md +++ b/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md @@ -139,7 +139,7 @@ None at the moment > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md index 76cb358237..36e29731e8 100644 --- a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md +++ b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md @@ -143,7 +143,7 @@ Some of these processes may be used legitimately on web servers during maintenan > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2019-04-25-suspicious_file_write.md b/docs/_posts/2019-04-25-suspicious_file_write.md index ab0f3c280d..dd9f2854a8 100644 --- a/docs/_posts/2019-04-25-suspicious_file_write.md +++ b/docs/_posts/2019-04-25-suspicious_file_write.md @@ -130,7 +130,7 @@ It's possible for a legitimate file to be created with the same name as one note > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md index 35ce40e363..903fc504cb 100644 --- a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md +++ b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md @@ -143,7 +143,7 @@ Some legitimate applications use long command lines for installs or updates. You > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md index 889de5619f..52db687451 100644 --- a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md +++ b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md @@ -102,9 +102,9 @@ This search looks for applications on the endpoint that you have marked as prohi #### Macros The SPL above uses the following Macros: +* [prohibited_softwares](https://github.com/splunk/security_content/blob/develop/macros/prohibited_softwares.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [prohibited_softwares](https://github.com/splunk/security_content/blob/develop/macros/prohibited_softwares.yml) > :information_source: > **prohibited_software_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -135,7 +135,7 @@ None identified > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md index 74303a6b39..875ff5b43e 100644 --- a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md +++ b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md @@ -153,7 +153,7 @@ The activity may be legitimate. Other tools can access lsass for legitimate reas > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md index 7939709a4a..445b0aa8ec 100644 --- a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md +++ b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md @@ -151,7 +151,7 @@ Other tools can import the same DLLs. These tools should be part of a whitelist. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md index ae1bfd429b..6228d32f4a 100644 --- a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md +++ b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md @@ -148,7 +148,7 @@ Administrators can create memory dumps for debugging purposes, but memory dumps > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md index e92bf175f0..01a8bca88b 100644 --- a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md +++ b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md @@ -148,7 +148,7 @@ Other tools can access LSASS for legitimate reasons and generate an event. In th > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md index 25227fec59..6ce1a2e91d 100644 --- a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md +++ b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md @@ -136,7 +136,7 @@ Other tools could load images into LSASS for legitimate reason. But enterprise t > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2019-12-10-creation_of_shadow_copy.md b/docs/_posts/2019-12-10-creation_of_shadow_copy.md index a07090a2a0..08da7eedb3 100644 --- a/docs/_posts/2019-12-10-creation_of_shadow_copy.md +++ b/docs/_posts/2019-12-10-creation_of_shadow_copy.md @@ -153,7 +153,7 @@ Legitimate administrator usage of Vssadmin or Wmic will create false positives. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md index 754ebd0944..0634b112b0 100644 --- a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md +++ b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md @@ -165,7 +165,7 @@ If you are seeing more results than desired, you may consider reducing the value > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md b/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md index 21dd883b58..42350216ad 100644 --- a/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md +++ b/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md @@ -146,7 +146,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md b/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md index ec4d2570f0..b47ad8cfe2 100644 --- a/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md +++ b/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md @@ -157,7 +157,7 @@ You will encounter noise from legitimate print-monitor registry entries. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md b/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md index 6c2b77b09a..207c95da6b 100644 --- a/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md +++ b/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md @@ -153,7 +153,7 @@ There are many legitimate applications that leverage shim databases for compatib > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-01-28-sdclt_uac_bypass.md b/docs/_posts/2020-01-28-sdclt_uac_bypass.md index 02707bb1a7..b77ba85fd5 100644 --- a/docs/_posts/2020-01-28-sdclt_uac_bypass.md +++ b/docs/_posts/2020-01-28-sdclt_uac_bypass.md @@ -148,7 +148,7 @@ Limited to no false positives are expected. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md b/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md index de3cbb556a..038de74027 100644 --- a/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md +++ b/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md @@ -148,7 +148,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-01-28-wsreset_uac_bypass.md b/docs/_posts/2020-01-28-wsreset_uac_bypass.md index 58923fe59a..81ff1f4cb3 100644 --- a/docs/_posts/2020-01-28-wsreset_uac_bypass.md +++ b/docs/_posts/2020-01-28-wsreset_uac_bypass.md @@ -149,7 +149,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md index 4eaaefea8a..e89e183dd1 100644 --- a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md +++ b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md @@ -146,7 +146,7 @@ Administrators can create memory dumps for debugging purposes, but memory dumps > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md b/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md index 1efdf25260..89f684f87a 100644 --- a/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md +++ b/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md @@ -108,8 +108,8 @@ This search looks for EC2 instances being created with previously unseen instanc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **ec2_instance_started_with_previously_unseen_instance_type_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -141,7 +141,7 @@ It is possible that an admin will create a new system using a new instance type > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md index fe8d0cdca2..39452d1266 100644 --- a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md +++ b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md @@ -138,7 +138,7 @@ At this stage, there are no known false positives. During testing, no process ev > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-02-20-gcp_gcr_container_uploaded.md b/docs/_posts/2020-02-20-gcp_gcr_container_uploaded.md index d9a4c0ab42..19682f6191 100644 --- a/docs/_posts/2020-02-20-gcp_gcr_container_uploaded.md +++ b/docs/_posts/2020-02-20-gcp_gcr_container_uploaded.md @@ -127,7 +127,7 @@ Uploading container is a normal behavior from developers or users with access to > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md index 62bba30526..0dcb29abc5 100644 --- a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md +++ b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md @@ -129,7 +129,7 @@ Uploading container is a normal behavior from developers or users with access to > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md index c94ba3167b..4da5e0416f 100644 --- a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md +++ b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md @@ -159,7 +159,7 @@ None identified. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-03-02-remote_registry_key_modifications.md b/docs/_posts/2020-03-02-remote_registry_key_modifications.md index c9762e2b1a..9182f443c0 100644 --- a/docs/_posts/2020-03-02-remote_registry_key_modifications.md +++ b/docs/_posts/2020-03-02-remote_registry_key_modifications.md @@ -130,7 +130,7 @@ This technique may be legitimately used by administrators to modify remote regis > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md index 2ee83ab29c..33c18be258 100644 --- a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md +++ b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md @@ -154,7 +154,7 @@ Some legitimate printer-related processes may show up as children of spoolsv.exe > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-03-16-detect_rare_executables.md b/docs/_posts/2020-03-16-detect_rare_executables.md index c334916b0c..49ce545359 100644 --- a/docs/_posts/2020-03-16-detect_rare_executables.md +++ b/docs/_posts/2020-03-16-detect_rare_executables.md @@ -114,8 +114,8 @@ This search will return a table of rare processes, the names of the systems runn #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml) > :information_source: > **detect_rare_executables_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -149,7 +149,7 @@ Some legitimate processes may be only rarely executed in your environment. As th > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-03-16-process_execution_via_wmi.md b/docs/_posts/2020-03-16-process_execution_via_wmi.md index 504f03412c..ee4bab1330 100644 --- a/docs/_posts/2020-03-16-process_execution_via_wmi.md +++ b/docs/_posts/2020-03-16-process_execution_via_wmi.md @@ -145,7 +145,7 @@ Although unlikely, administrators may use wmi to execute commands for legitimate > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-03-16-script_execution_via_wmi.md b/docs/_posts/2020-03-16-script_execution_via_wmi.md index 302155c2f8..8cfa6e77a5 100644 --- a/docs/_posts/2020-03-16-script_execution_via_wmi.md +++ b/docs/_posts/2020-03-16-script_execution_via_wmi.md @@ -143,7 +143,7 @@ Although unlikely, administrators may use wmi to launch scripts for legitimate p > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-03-16-spike_in_file_writes.md b/docs/_posts/2020-03-16-spike_in_file_writes.md index 72c8616da9..7e3c952049 100644 --- a/docs/_posts/2020-03-16-spike_in_file_writes.md +++ b/docs/_posts/2020-03-16-spike_in_file_writes.md @@ -134,7 +134,7 @@ It is important to understand that if you happen to install any new applications > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md index f2accc3ed8..f8e8536bb0 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md @@ -143,7 +143,7 @@ Not all unauthenticated requests are malicious, but frequency, UA and source IPs > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md index 1a41c9546a..a963f0417f 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md @@ -144,7 +144,7 @@ Not all unauthenticated requests are malicious, but frequency, UA and source IPs > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md index a90fe76924..3937632e2a 100644 --- a/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md +++ b/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md @@ -132,7 +132,7 @@ Not all unauthenticated requests are malicious, but frequency, User Agent and so > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-05-19-kubernetes_azure_scan_fingerprint.md b/docs/_posts/2020-05-19-kubernetes_azure_scan_fingerprint.md index e53d774e00..36dfc30861 100644 --- a/docs/_posts/2020-05-19-kubernetes_azure_scan_fingerprint.md +++ b/docs/_posts/2020-05-19-kubernetes_azure_scan_fingerprint.md @@ -129,7 +129,7 @@ Not all unauthenticated requests are malicious, but source IPs, userAgent, verb, > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md index a59eed5e9e..6314c7448b 100644 --- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md +++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md @@ -113,9 +113,9 @@ This search looks for child processes spawned by zoom.exe or zoom.us that has no #### Macros The SPL above uses the following Macros: +* [previously_seen_zoom_child_processes_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_zoom_child_processes_window.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [previously_seen_zoom_child_processes_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_zoom_child_processes_window.yml) > :information_source: > **first_time_seen_child_process_of_zoom_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -156,7 +156,7 @@ A new child process of zoom isn't malicious by that fact alone. Further investig > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_object_access.md b/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_object_access.md index 2d7608091c..a83b69baa0 100644 --- a/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_object_access.md +++ b/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_object_access.md @@ -122,7 +122,7 @@ Sensitive object access is not necessarily malicious but user and object context > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_role_access.md b/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_role_access.md index b1aaeaecc1..999685f9e7 100644 --- a/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_role_access.md +++ b/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_role_access.md @@ -122,7 +122,7 @@ Sensitive role resource access is necessary for cluster operation, however sourc > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-05-20-kubernetes_azure_detect_service_accounts_forbidden_failure_access.md b/docs/_posts/2020-05-20-kubernetes_azure_detect_service_accounts_forbidden_failure_access.md index 0477e1aeb6..57ba835865 100644 --- a/docs/_posts/2020-05-20-kubernetes_azure_detect_service_accounts_forbidden_failure_access.md +++ b/docs/_posts/2020-05-20-kubernetes_azure_detect_service_accounts_forbidden_failure_access.md @@ -121,7 +121,7 @@ This search can give false positives as there might be inherent issues with auth > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-05-20-kubernetes_azure_pod_scan_fingerprint.md b/docs/_posts/2020-05-20-kubernetes_azure_pod_scan_fingerprint.md index 8864562f5d..ff0236cf16 100644 --- a/docs/_posts/2020-05-20-kubernetes_azure_pod_scan_fingerprint.md +++ b/docs/_posts/2020-05-20-kubernetes_azure_pod_scan_fingerprint.md @@ -121,7 +121,7 @@ Not all unauthenticated requests are malicious, but source IPs, userAgent, verb, > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-05-26-kubernetes_azure_active_service_accounts_by_pod_namespace.md b/docs/_posts/2020-05-26-kubernetes_azure_active_service_accounts_by_pod_namespace.md index c8fcdf8b74..8822a44cf5 100644 --- a/docs/_posts/2020-05-26-kubernetes_azure_active_service_accounts_by_pod_namespace.md +++ b/docs/_posts/2020-05-26-kubernetes_azure_active_service_accounts_by_pod_namespace.md @@ -122,7 +122,7 @@ Not all service accounts interactions are malicious. Analyst must consider IP an > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-05-26-kubernetes_azure_detect_rbac_authorization_by_account.md b/docs/_posts/2020-05-26-kubernetes_azure_detect_rbac_authorization_by_account.md index 8df5c22093..76c3469a2e 100644 --- a/docs/_posts/2020-05-26-kubernetes_azure_detect_rbac_authorization_by_account.md +++ b/docs/_posts/2020-05-26-kubernetes_azure_detect_rbac_authorization_by_account.md @@ -123,7 +123,7 @@ Not all RBAC Authorications are malicious. RBAC authorizations can uncover malic > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-05-26-kubernetes_azure_detect_suspicious_kubectl_calls.md b/docs/_posts/2020-05-26-kubernetes_azure_detect_suspicious_kubectl_calls.md index f724f7b4c8..bf7375293b 100644 --- a/docs/_posts/2020-05-26-kubernetes_azure_detect_suspicious_kubectl_calls.md +++ b/docs/_posts/2020-05-26-kubernetes_azure_detect_suspicious_kubectl_calls.md @@ -123,7 +123,7 @@ Kubectl calls are not malicious by nature. However source IP, verb and Object ca > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md b/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md index 692580fb4b..32c6d8bbf7 100644 --- a/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md +++ b/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md @@ -145,7 +145,7 @@ Using multiple AWS accounts and roles is perfectly valid behavior. It's suspicio > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-06-23-aws_eks_kubernetes_cluster_sensitive_object_access.md b/docs/_posts/2020-06-23-aws_eks_kubernetes_cluster_sensitive_object_access.md index 9221290cc0..857a1af639 100644 --- a/docs/_posts/2020-06-23-aws_eks_kubernetes_cluster_sensitive_object_access.md +++ b/docs/_posts/2020-06-23-aws_eks_kubernetes_cluster_sensitive_object_access.md @@ -120,7 +120,7 @@ Sensitive object access is not necessarily malicious but user and object context > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_most_active_service_accounts_by_pod.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_most_active_service_accounts_by_pod.md index 654633ad5d..17d6b651cd 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_most_active_service_accounts_by_pod.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_most_active_service_accounts_by_pod.md @@ -120,7 +120,7 @@ Not all service accounts interactions are malicious. Analyst must consider IP, v > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_rbac_authorization_by_account.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_rbac_authorization_by_account.md index 88267735d2..527c1cbb72 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_rbac_authorization_by_account.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_rbac_authorization_by_account.md @@ -121,7 +121,7 @@ Not all RBAC Authorications are malicious. RBAC authorizations can uncover malic > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_sensitive_role_access.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_sensitive_role_access.md index 64776ab859..5fbb443ddb 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_sensitive_role_access.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_sensitive_role_access.md @@ -120,7 +120,7 @@ Sensitive role resource access is necessary for cluster operation, however sourc > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_service_accounts_forbidden_failure_access.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_service_accounts_forbidden_failure_access.md index 7d99f1e970..5f9aabff04 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_service_accounts_forbidden_failure_access.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_service_accounts_forbidden_failure_access.md @@ -119,7 +119,7 @@ This search can give false positives as there might be inherent issues with auth > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md index 8d072e3de6..cccf5193a7 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md @@ -128,7 +128,7 @@ Kubectl calls are not malicious by nature. However source IP, verb and Object ca > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-06-23-kubernetes_gcp_detect_service_accounts_forbidden_failure_access.md b/docs/_posts/2020-06-23-kubernetes_gcp_detect_service_accounts_forbidden_failure_access.md index 160a9a0a08..dcefd7f403 100644 --- a/docs/_posts/2020-06-23-kubernetes_gcp_detect_service_accounts_forbidden_failure_access.md +++ b/docs/_posts/2020-06-23-kubernetes_gcp_detect_service_accounts_forbidden_failure_access.md @@ -120,7 +120,7 @@ This search can give false positives as there might be inherent issues with auth > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md index 9966d9fc64..e170e0f832 100644 --- a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md +++ b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md @@ -164,7 +164,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-06-short_lived_windows_accounts.md b/docs/_posts/2020-07-06-short_lived_windows_accounts.md index 96c8cd9727..3412fb9342 100644 --- a/docs/_posts/2020-07-06-short_lived_windows_accounts.md +++ b/docs/_posts/2020-07-06-short_lived_windows_accounts.md @@ -147,7 +147,7 @@ It is possible that an administrator created and deleted an account in a short t > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-06-windows_event_log_cleared.md b/docs/_posts/2020-07-06-windows_event_log_cleared.md index 57ce4494b1..610808a839 100644 --- a/docs/_posts/2020-07-06-windows_event_log_cleared.md +++ b/docs/_posts/2020-07-06-windows_event_log_cleared.md @@ -115,9 +115,9 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_event_log_cleared_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -150,7 +150,7 @@ It is possible that these logs may be legitimately cleared by Administrators. Fi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md index de86017e13..545796a26c 100644 --- a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md +++ b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md @@ -156,7 +156,7 @@ Remote Desktop may be used legitimately by users on the network. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-08-detect_new_local_admin_account.md b/docs/_posts/2020-07-08-detect_new_local_admin_account.md index 83fdcda467..3e6512d9d8 100644 --- a/docs/_posts/2020-07-08-detect_new_local_admin_account.md +++ b/docs/_posts/2020-07-08-detect_new_local_admin_account.md @@ -149,7 +149,7 @@ The activity may be legitimate. For this reason, it's best to verify the account > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-10-kubernetes_gcp_detect_most_active_service_accounts_by_pod.md b/docs/_posts/2020-07-10-kubernetes_gcp_detect_most_active_service_accounts_by_pod.md index 634105e751..feb73ec06a 100644 --- a/docs/_posts/2020-07-10-kubernetes_gcp_detect_most_active_service_accounts_by_pod.md +++ b/docs/_posts/2020-07-10-kubernetes_gcp_detect_most_active_service_accounts_by_pod.md @@ -120,7 +120,7 @@ Not all service accounts interactions are malicious. Analyst must consider IP, v > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-11-kubernetes_gcp_detect_rbac_authorizations_by_account.md b/docs/_posts/2020-07-11-kubernetes_gcp_detect_rbac_authorizations_by_account.md index b3857935fb..6be0597aa9 100644 --- a/docs/_posts/2020-07-11-kubernetes_gcp_detect_rbac_authorizations_by_account.md +++ b/docs/_posts/2020-07-11-kubernetes_gcp_detect_rbac_authorizations_by_account.md @@ -120,7 +120,7 @@ Not all RBAC Authorications are malicious. RBAC authorizations can uncover malic > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_object_access.md b/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_object_access.md index ab7b2af297..0c7e245591 100644 --- a/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_object_access.md +++ b/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_object_access.md @@ -120,7 +120,7 @@ Sensitive object access is not necessarily malicious but user and object context > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_role_access.md b/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_role_access.md index ed142f01b1..d81d2ffbba 100644 --- a/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_role_access.md +++ b/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_role_access.md @@ -120,7 +120,7 @@ Sensitive role resource access is necessary for cluster operation, however sourc > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-11-kubernetes_gcp_detect_suspicious_kubectl_calls.md b/docs/_posts/2020-07-11-kubernetes_gcp_detect_suspicious_kubectl_calls.md index 042925f1f0..f908f11f35 100644 --- a/docs/_posts/2020-07-11-kubernetes_gcp_detect_suspicious_kubectl_calls.md +++ b/docs/_posts/2020-07-11-kubernetes_gcp_detect_suspicious_kubectl_calls.md @@ -120,7 +120,7 @@ Kubectl calls are not malicious by nature. However source IP, source user, user > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md index 29fd0f9449..a2cd8ed0ac 100644 --- a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md +++ b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md @@ -139,7 +139,7 @@ Not all unauthenticated requests are malicious, but frequency, User Agent, sourc > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user.md b/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user.md index 9a8747995f..539d7a9e2e 100644 --- a/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user.md +++ b/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user.md @@ -146,7 +146,7 @@ Many service accounts configured within an AWS infrastructure are known to exhib > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user_-_mltk.md b/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user_-_mltk.md index dfb59547fe..37c866d798 100644 --- a/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user_-_mltk.md +++ b/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user_-_mltk.md @@ -142,7 +142,7 @@ Many service accounts configured within an AWS infrastructure are known to exhib > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user.md b/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user.md index ef87c4ba5d..43c1ded8d9 100644 --- a/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user.md +++ b/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user.md @@ -145,7 +145,7 @@ Many service accounts configured with your AWS infrastructure are known to exhib > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user_-_mltk.md b/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user_-_mltk.md index 1ee2891b37..efcb916ee8 100644 --- a/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user_-_mltk.md +++ b/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user_-_mltk.md @@ -141,7 +141,7 @@ Many service accounts configured within an AWS infrastructure are known to exhib > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md index 499d9cc18c..e63eaaca93 100644 --- a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md +++ b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md @@ -167,7 +167,7 @@ None identified. Attempts to disable security-related services should be identif > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-clients_connecting_to_multiple_dns_servers.md b/docs/_posts/2020-07-21-clients_connecting_to_multiple_dns_servers.md index 830148cba5..7141cbd45d 100644 --- a/docs/_posts/2020-07-21-clients_connecting_to_multiple_dns_servers.md +++ b/docs/_posts/2020-07-21-clients_connecting_to_multiple_dns_servers.md @@ -146,7 +146,7 @@ It's possible that an enterprise has more than five DNS servers that are configu > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md b/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md index 0e6524ee31..899c3b213b 100644 --- a/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md +++ b/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md @@ -118,8 +118,8 @@ This search looks for successful AWS CloudTrail activity by user accounts that a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_aws_api_activities_from_unapproved_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -163,7 +163,7 @@ It's likely that you'll find activity detected by users/service accounts that ar > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md index b11e775c70..7e8954d25d 100644 --- a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md +++ b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md @@ -123,14 +123,14 @@ This search looks for DNS requests for phishing domains that are leveraging Evil #### Macros The SPL above uses the following Macros: -* [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml) -* [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml) -* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml) -* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml) -* [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml) * [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml) * [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml) +* [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml) +* [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml) +* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml) +* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml) > :information_source: > **detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -168,7 +168,7 @@ If a known good domain is not listed in the legit_domains.csv file, then the sea > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md index ccb568a8e3..e9fd64eac7 100644 --- a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md +++ b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md @@ -152,7 +152,7 @@ It is possible that a legitimate user is experiencing an issue causing multiple > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md b/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md index 236c388e61..8a71757140 100644 --- a/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md +++ b/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md @@ -151,7 +151,7 @@ It's possible that legitimate TXT record responses can be long enough to trigger > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md b/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md index 5a3a944eb6..a7eb0b73a1 100644 --- a/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md +++ b/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md @@ -113,8 +113,8 @@ This search looks for AWS CloudTrail events wherein a console login event by a u #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_new_user_aws_console_login_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -145,7 +145,7 @@ When a legitimate new user logins for the first time, this activity will be dete > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md index 095e0becf3..0282f5b820 100644 --- a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md +++ b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md @@ -153,7 +153,7 @@ It is likely that the outbound Server Message Block (SMB) traffic is legitimate, > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md index f63bd93959..d8e12c392f 100644 --- a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md +++ b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md @@ -162,7 +162,7 @@ It is not uncommon for outlook to write legitimate zip files to the disk. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-detect_spike_in_aws_api_activity.md b/docs/_posts/2020-07-21-detect_spike_in_aws_api_activity.md index 1e97e020bb..b5b8ea361f 100644 --- a/docs/_posts/2020-07-21-detect_spike_in_aws_api_activity.md +++ b/docs/_posts/2020-07-21-detect_spike_in_aws_api_activity.md @@ -167,7 +167,7 @@ Detailed documentation on how to create a new field within Incident Review may b > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md index fffd3e2cd1..190ba0c31f 100644 --- a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md +++ b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md @@ -149,7 +149,7 @@ Some legitimate applications may exhibit this behavior. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md index 3a268ba8d5..499553bcaf 100644 --- a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md +++ b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md @@ -110,8 +110,8 @@ This search looks for web connections to dynamic DNS providers. #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml) > :information_source: > **detect_web_traffic_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -146,7 +146,7 @@ It is possible that list of dynamic DNS providers is outdated and/or that the UR > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md index f1847426f7..79bd71b2c0 100644 --- a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md +++ b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md @@ -144,7 +144,7 @@ While legitimate, these NirSoft tools are prone to abuse. You should verfiy that > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-dns_query_requests_resolved_by_unauthorized_dns_servers.md b/docs/_posts/2020-07-21-dns_query_requests_resolved_by_unauthorized_dns_servers.md index 3be35d640c..8209ea0b8c 100644 --- a/docs/_posts/2020-07-21-dns_query_requests_resolved_by_unauthorized_dns_servers.md +++ b/docs/_posts/2020-07-21-dns_query_requests_resolved_by_unauthorized_dns_servers.md @@ -147,7 +147,7 @@ Legitimate DNS activity can be detected in this search. Investigate, verify and > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-dns_record_changed.md b/docs/_posts/2020-07-21-dns_record_changed.md index 9acf678e0c..075b207ee2 100644 --- a/docs/_posts/2020-07-21-dns_record_changed.md +++ b/docs/_posts/2020-07-21-dns_record_changed.md @@ -169,7 +169,7 @@ Legitimate DNS changes can be detected in this search. Investigate, verify and u > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md index 8c60af6e5e..5a4f09b92f 100644 --- a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md +++ b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md @@ -118,9 +118,9 @@ This search looks for EC2 instances being modified by users who have not previou #### Macros The SPL above uses the following Macros: -* [ec2_modification_api_calls](https://github.com/splunk/security_content/blob/develop/macros/ec2_modification_api_calls.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [ec2_modification_api_calls](https://github.com/splunk/security_content/blob/develop/macros/ec2_modification_api_calls.yml) > :information_source: > **ec2_instance_modified_with_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -157,7 +157,7 @@ It's possible that a new user will start to modify EC2 instances when they haven > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md b/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md index 544d38067b..f37bf58289 100644 --- a/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md +++ b/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md @@ -117,8 +117,8 @@ This search looks for EC2 instances being created by users who have not created #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **ec2_instance_started_with_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -151,7 +151,7 @@ It's possible that a user will start to create EC2 instances when they haven't b > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md index 7692b49352..602677cc95 100644 --- a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md +++ b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md @@ -146,7 +146,7 @@ Administrators and users sometimes prefer backing up their email data by moving > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md index 40ddae5064..4d71eec0cf 100644 --- a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md +++ b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md @@ -152,7 +152,7 @@ The false-positive rate will vary based on how you set the deviation_threshold a > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-excessive_dns_failures.md b/docs/_posts/2020-07-21-excessive_dns_failures.md index 5a532eccba..873bef1137 100644 --- a/docs/_posts/2020-07-21-excessive_dns_failures.md +++ b/docs/_posts/2020-07-21-excessive_dns_failures.md @@ -155,7 +155,7 @@ It is possible legitimate traffic can trigger this rule. Please investigate as a > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md b/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md index a2cd505783..29a348aab2 100644 --- a/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md +++ b/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md @@ -170,7 +170,7 @@ Legitimate programs can also use command-line arguments to execute. Please verif > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md index 3f65608097..3f454963e2 100644 --- a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md +++ b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md @@ -118,8 +118,8 @@ This search looks for the first and last time a Windows service is seen running #### Macros The SPL above uses the following Macros: -* [previously_seen_windows_services_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_windows_services_window.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [previously_seen_windows_services_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_windows_services_window.yml) > :information_source: > **first_time_seen_running_windows_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -158,7 +158,7 @@ A previously unseen service is not necessarily malicious. Verify that the servic > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md index 1300f82e7e..9eca0f6f84 100644 --- a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md +++ b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md @@ -147,7 +147,7 @@ Some applications and users may legitimately use attrib.exe to interact with the > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md index 254098fbd5..ef0ed5756f 100644 --- a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md +++ b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md @@ -151,7 +151,7 @@ The false-positive rate will vary based on how you set the deviation_threshold a > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md index 4335d1cae2..9372642573 100644 --- a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md +++ b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md @@ -159,7 +159,7 @@ There may be legitimate reasons to bypass the PowerShell execution policy. The P > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md index 67b077fd7c..85c2cd05e5 100644 --- a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md +++ b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md @@ -156,7 +156,7 @@ A single public IP address servicing multiple legitmate users may trigger this s > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-okta_account_lockout_events.md b/docs/_posts/2020-07-21-okta_account_lockout_events.md index 950d260a4a..3e61a87988 100644 --- a/docs/_posts/2020-07-21-okta_account_lockout_events.md +++ b/docs/_posts/2020-07-21-okta_account_lockout_events.md @@ -149,7 +149,7 @@ None. Account lockouts should be followed up on to determine if the actual user > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md index b8a910cb3c..caa4fab851 100644 --- a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md +++ b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md @@ -152,7 +152,7 @@ There may be a faulty config preventing legitmate users from accessing apps they > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md index b22b9ddc09..212ff4ee2b 100644 --- a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md +++ b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md @@ -152,7 +152,7 @@ Users in your enviornment may legitmately be travelling and loggin in from diffe > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md index bb480e4e30..3d3a23142f 100644 --- a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md +++ b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md @@ -149,7 +149,7 @@ Microsoft may provide updates to these binaries. Verify that these changes do no > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md index de40ec98dd..631e7a941c 100644 --- a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md +++ b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md @@ -149,7 +149,7 @@ None identified > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md index 9db7878838..2a83d0b689 100644 --- a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md +++ b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md @@ -150,7 +150,7 @@ None identified > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md index cc13491611..0092abd883 100644 --- a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md +++ b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md @@ -153,7 +153,7 @@ RDP gateways may have unusually high amounts of traffic from all other hosts' RD > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md index f6b751b8c8..80127df206 100644 --- a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md +++ b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md @@ -152,7 +152,7 @@ Remote Desktop may be used legitimately by users on the network. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md index 2809e872ca..c77f07964f 100644 --- a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md +++ b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md @@ -159,7 +159,7 @@ Using sc.exe to manipulate Windows services is uncommon. However, there may be l > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md b/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md index 93158bad76..1e8576cece 100644 --- a/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md +++ b/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md @@ -139,7 +139,7 @@ No known false positives > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-22-smb_traffic_spike.md b/docs/_posts/2020-07-22-smb_traffic_spike.md index 7d528165f0..6873538aff 100644 --- a/docs/_posts/2020-07-22-smb_traffic_spike.md +++ b/docs/_posts/2020-07-22-smb_traffic_spike.md @@ -151,7 +151,7 @@ A file server may experience high-demand loads that could cause this analytic to > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md index 570b9a6312..cfd5b27ab8 100644 --- a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md +++ b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md @@ -157,7 +157,7 @@ If you are seeing more results than desired, you may consider reducing the value > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md b/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md index d0a87ff921..ee8e48bbb9 100644 --- a/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md +++ b/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md @@ -144,7 +144,7 @@ There may be other processes in your environment that users may legitimately use > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md b/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md index baf1b346d7..8610cdf3c4 100644 --- a/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md +++ b/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md @@ -137,7 +137,7 @@ This detection model will alert on any sender domain that is seen for the first > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md index cdb3e48687..4118197c48 100644 --- a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md +++ b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md @@ -155,7 +155,7 @@ None identified > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md index ffb70169e7..a04b2b45ac 100644 --- a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md +++ b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md @@ -153,7 +153,7 @@ It's possible for system administrators to write scripts that exhibit this behav > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md index 50cb09ba63..9b0f587725 100644 --- a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md +++ b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md @@ -134,7 +134,7 @@ It is possible that other utilities or system processes may legitimately write t > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md b/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md index 39b9dd913b..f1e697f952 100644 --- a/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md +++ b/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md @@ -145,7 +145,7 @@ Because the Recycle Bin is a hidden folder in modern versions of Windows, it wou > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-22-tor_traffic.md b/docs/_posts/2020-07-22-tor_traffic.md index 247d47f93c..f6411060b4 100644 --- a/docs/_posts/2020-07-22-tor_traffic.md +++ b/docs/_posts/2020-07-22-tor_traffic.md @@ -152,7 +152,7 @@ None at this time > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md index 7a2e68e15c..490d46bae2 100644 --- a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md +++ b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md @@ -108,9 +108,9 @@ This search looks for applications on the endpoint that you have marked as uncom #### Macros The SPL above uses the following Macros: -* [uncommon_processes](https://github.com/splunk/security_content/blob/develop/macros/uncommon_processes.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [uncommon_processes](https://github.com/splunk/security_content/blob/develop/macros/uncommon_processes.yml) > :information_source: > **uncommon_processes_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -141,7 +141,7 @@ None identified > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md b/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md index 817c79db6e..3cd964fa66 100644 --- a/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md +++ b/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md @@ -148,7 +148,7 @@ You must be ingesting data that records process activity from your hosts to popu > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md index 7de9810079..f244f1b407 100644 --- a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md +++ b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md @@ -134,7 +134,7 @@ Attach to policy can create a lot of noise. This search can be adjusted to provi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md index 057c9bdb9a..96d1918cb8 100644 --- a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md +++ b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md @@ -144,7 +144,7 @@ Not all permanent key creations are malicious. If there is a policy of rotating > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-27-aws_detect_role_creation.md b/docs/_posts/2020-07-27-aws_detect_role_creation.md index 7e2f60f32a..6bb03c240f 100644 --- a/docs/_posts/2020-07-27-aws_detect_role_creation.md +++ b/docs/_posts/2020-07-27-aws_detect_role_creation.md @@ -149,7 +149,7 @@ CreateRole is not very common in common users. This search can be adjusted to pr > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md index fd0b96d06c..b5a83d1228 100644 --- a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md +++ b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md @@ -143,7 +143,7 @@ Sts:AssumeRole can be very noisy as it is a standard mechanism to provide cross > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md index 1db0c81482..5eb316ad2a 100644 --- a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md +++ b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md @@ -142,7 +142,7 @@ Sts:GetSessionToken can be very noisy as in certain environments numerous calls > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md index 99bc5ce192..ed73e8c274 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md @@ -147,7 +147,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md index 5ad0ca9be6..c3a70bd263 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md @@ -151,7 +151,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md index ed79d1eb20..86f9ad6e66 100644 --- a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md +++ b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md @@ -163,7 +163,7 @@ It's possible that a new user will start to modify EC2 instances when they haven > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md index 4ead28c950..0bf065f1fb 100644 --- a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md +++ b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md @@ -140,7 +140,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md index cdef5be4db..1b4266809c 100644 --- a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md +++ b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md @@ -152,7 +152,7 @@ While this search has no known false positives, it is possible that a GCP admin > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md index 71031283aa..acf476a817 100644 --- a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md +++ b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md @@ -163,7 +163,7 @@ GCP Storage buckets can be accessed from any IP (if the ACLs are open to allow i > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-08-11-detect_arp_poisoning.md b/docs/_posts/2020-08-11-detect_arp_poisoning.md index 0752fc5503..d979e3ae58 100644 --- a/docs/_posts/2020-08-11-detect_arp_poisoning.md +++ b/docs/_posts/2020-08-11-detect_arp_poisoning.md @@ -165,7 +165,7 @@ This search might be prone to high false positives if DHCP Snooping or ARP inspe > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md index 43d526ffa5..8b78997c54 100644 --- a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md +++ b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md @@ -156,7 +156,7 @@ This search might be prone to high false positives if DHCP Snooping has been inc > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md index c087d8625c..5d755ac2d1 100644 --- a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md +++ b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md @@ -156,7 +156,7 @@ This is a strictly behavioral search, so we define "false positive" slightly dif > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md index 2c0d8b56e5..ec5531bf28 100644 --- a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md +++ b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md @@ -158,7 +158,7 @@ This is a strictly behavioral search, so we define "false positive" slightly dif > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md index 20c0efb905..5169315b7a 100644 --- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md +++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md @@ -163,7 +163,7 @@ Many service accounts configured within a cloud infrastructure are known to exhi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md index 532a074da1..8e4de14598 100644 --- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md +++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md @@ -164,7 +164,7 @@ Many service accounts configured within an AWS infrastructure are known to exhib > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-09-01-gcp_detect_oauth_token_abuse.md b/docs/_posts/2020-09-01-gcp_detect_oauth_token_abuse.md index fb7bc54890..ccedfd0460 100644 --- a/docs/_posts/2020-09-01-gcp_detect_oauth_token_abuse.md +++ b/docs/_posts/2020-09-01-gcp_detect_oauth_token_abuse.md @@ -130,7 +130,7 @@ GCP Oauth token abuse detection will only work if there are access policies in p > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md b/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md index c296e5bf0f..ccd7bb4de7 100644 --- a/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md +++ b/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md @@ -150,7 +150,7 @@ It's possible that a user has unknowingly started an instance in a new region. P > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md b/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md index a89cace58a..3111f5ba42 100644 --- a/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md +++ b/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md @@ -154,7 +154,7 @@ You must be ingesting your cloud infrastructure logs from your cloud provider. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md index 21e2b92280..82531f443b 100644 --- a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md +++ b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md @@ -161,7 +161,7 @@ You must be ingesting your cloud infrastructure logs. You also must run the base > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md index 6b9d25d118..8ad2f03735 100644 --- a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md +++ b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md @@ -162,7 +162,7 @@ You must be ingesting your cloud infrastructure logs. You also must run the base > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md b/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md index 3b3f0a18be..7ef5a0acff 100644 --- a/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md +++ b/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md @@ -98,8 +98,8 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **cloud_network_access_control_list_deleted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -136,7 +136,7 @@ It's possible that a user has legitimately deleted a network ACL. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md b/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md index 64c3c1f9dd..e17374d24e 100644 --- a/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md +++ b/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md @@ -143,7 +143,7 @@ It is possible that an admin will create a new system using a new instance type > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md index 2fc6d92d8d..b9449d4252 100644 --- a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md +++ b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md @@ -142,7 +142,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md index be54cb74f9..8b02b31f89 100644 --- a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md +++ b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md @@ -155,7 +155,7 @@ Administrators often leverage net.exe to create or delete network shares. You sh > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md index dc228a36ff..8ddd5dd1cf 100644 --- a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md +++ b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md @@ -145,7 +145,7 @@ None thus far found > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md index 9ee267ad79..3ab32e1a92 100644 --- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md +++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md @@ -155,7 +155,7 @@ When a legitimate new user logins for the first time, this activity will be dete > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md index 0fde12e800..f72f7a8ed3 100644 --- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md +++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md @@ -155,7 +155,7 @@ When a legitimate new user logins for the first time, this activity will be dete > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md index 1f91e6903d..35f900bb8d 100644 --- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md +++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md @@ -155,7 +155,7 @@ When a legitimate new user logins for the first time, this activity will be dete > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md index aa535ba6cc..8aa8408d06 100644 --- a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md +++ b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md @@ -140,7 +140,7 @@ Payload.request.function.timeout value can possibly be match with other function > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md index e3c728eb78..f0a1718ed9 100644 --- a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md +++ b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md @@ -158,7 +158,7 @@ This is a strictly behavioral search, so we define "false positive" slightly dif > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md index e064cb3acc..01ba185772 100644 --- a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md +++ b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md @@ -157,7 +157,7 @@ This is a strictly behavioral search, so we define "false positive" slightly dif > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-10-09-gcp_detect_accounts_with_high_risk_roles_by_project.md b/docs/_posts/2020-10-09-gcp_detect_accounts_with_high_risk_roles_by_project.md index 1a6441339c..20294cef79 100644 --- a/docs/_posts/2020-10-09-gcp_detect_accounts_with_high_risk_roles_by_project.md +++ b/docs/_posts/2020-10-09-gcp_detect_accounts_with_high_risk_roles_by_project.md @@ -136,7 +136,7 @@ Accounts with high risk roles should be reduced to the minimum number needed, ho > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-10-09-gcp_detect_high_risk_permissions_by_resource_and_account.md b/docs/_posts/2020-10-09-gcp_detect_high_risk_permissions_by_resource_and_account.md index ac97b4b4d7..492ffb66c4 100644 --- a/docs/_posts/2020-10-09-gcp_detect_high_risk_permissions_by_resource_and_account.md +++ b/docs/_posts/2020-10-09-gcp_detect_high_risk_permissions_by_resource_and_account.md @@ -136,7 +136,7 @@ High risk permissions are part of any GCP environment, however it is important t > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md index d0b9b40fbe..8afe9011b3 100644 --- a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md +++ b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md @@ -153,7 +153,7 @@ Legitimate logon activity by authorized NTLM systems may be detected by this sea > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md index 6326887355..4c94624b42 100644 --- a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md +++ b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md @@ -151,7 +151,7 @@ Unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md index 2d5634c5b4..c7023ed7fd 100644 --- a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md +++ b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md @@ -170,7 +170,7 @@ None currently known > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-10-28-detect_port_security_violation.md b/docs/_posts/2020-10-28-detect_port_security_violation.md index 28877b30b2..f4b280451b 100644 --- a/docs/_posts/2020-10-28-detect_port_security_violation.md +++ b/docs/_posts/2020-10-28-detect_port_security_violation.md @@ -169,7 +169,7 @@ This search might be prone to high false positives if you have malfunctioning de > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md index 8d4f5efe9d..11f87c2188 100644 --- a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md +++ b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md @@ -153,7 +153,7 @@ This search will also report any legitimate attempts of software downloads to ne > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-10-28-detect_traffic_mirroring.md b/docs/_posts/2020-10-28-detect_traffic_mirroring.md index dbabb833ba..5275e8e08a 100644 --- a/docs/_posts/2020-10-28-detect_traffic_mirroring.md +++ b/docs/_posts/2020-10-28-detect_traffic_mirroring.md @@ -157,7 +157,7 @@ This search will return false positives for any legitimate traffic captures by n > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-11-06-ryuk_test_files_detected.md b/docs/_posts/2020-11-06-ryuk_test_files_detected.md index 6a66bed515..0d1c5cff53 100644 --- a/docs/_posts/2020-11-06-ryuk_test_files_detected.md +++ b/docs/_posts/2020-11-06-ryuk_test_files_detected.md @@ -139,7 +139,7 @@ If there are files with this keywoord as file names it might trigger false possi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md b/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md index 4bdd7de48a..aad62e03e2 100644 --- a/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md +++ b/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md @@ -136,7 +136,7 @@ This process should not be ran forcefully, we have not see any false positives f > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md index d99aeff9a0..455f8b1e96 100644 --- a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md +++ b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md @@ -140,7 +140,7 @@ SAM is a critical windows service, stopping it would cause major issues on an en > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-11-09-common_ransomware_extensions.md b/docs/_posts/2020-11-09-common_ransomware_extensions.md index 79ee301ed0..dc37dca253 100644 --- a/docs/_posts/2020-11-09-common_ransomware_extensions.md +++ b/docs/_posts/2020-11-09-common_ransomware_extensions.md @@ -151,7 +151,7 @@ It is possible for a legitimate file with these extensions to be created. If thi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-11-09-common_ransomware_notes.md b/docs/_posts/2020-11-09-common_ransomware_notes.md index 59d111606c..315432c79b 100644 --- a/docs/_posts/2020-11-09-common_ransomware_notes.md +++ b/docs/_posts/2020-11-09-common_ransomware_notes.md @@ -146,7 +146,7 @@ It's possible that a legitimate file could be created with the same name used by > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-11-09-deleting_shadow_copies.md b/docs/_posts/2020-11-09-deleting_shadow_copies.md index 16692424ea..f6b57fe6ab 100644 --- a/docs/_posts/2020-11-09-deleting_shadow_copies.md +++ b/docs/_posts/2020-11-09-deleting_shadow_copies.md @@ -153,7 +153,7 @@ vssadmin.exe and wmic.exe are standard applications shipped with modern versions > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md index de24ad37ea..2deda244e4 100644 --- a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md +++ b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md @@ -157,7 +157,7 @@ It's possible that a widely used system, such as a kiosk, could cause a large nu > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md index 8875fc791c..151a1b664f 100644 --- a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md +++ b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md @@ -114,8 +114,8 @@ This search looks for fast execution of processes used for system network config #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [system_network_configuration_discovery_tools](https://github.com/splunk/security_content/blob/develop/macros/system_network_configuration_discovery_tools.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [system_network_configuration_discovery_tools](https://github.com/splunk/security_content/blob/develop/macros/system_network_configuration_discovery_tools.yml) > :information_source: > **detect_processes_used_for_system_network_configuration_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -155,7 +155,7 @@ It is uncommon for normal users to execute a series of commands used for network > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md index 48fee0d1f4..fe972a76d4 100644 --- a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md +++ b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md @@ -113,9 +113,9 @@ This search looks for executions of cmd.exe spawned by a process that is often a #### Macros The SPL above uses the following Macros: +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml) > :information_source: @@ -159,7 +159,7 @@ There are circumstances where an application may legitimately execute and intera > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-11-18-disabling_remote_user_account_control.md b/docs/_posts/2020-11-18-disabling_remote_user_account_control.md index 15b67e345c..87179c282f 100644 --- a/docs/_posts/2020-11-18-disabling_remote_user_account_control.md +++ b/docs/_posts/2020-11-18-disabling_remote_user_account_control.md @@ -149,7 +149,7 @@ This registry key may be modified via administrators to implement a change in sy > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md index f263bd94f6..83b2b703c9 100644 --- a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md +++ b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md @@ -149,7 +149,7 @@ None identified. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md b/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md index e29e4ba88a..5850ce8104 100644 --- a/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md +++ b/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md @@ -145,7 +145,7 @@ None identified. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-11-23-processes_created_by_netsh.md b/docs/_posts/2020-11-23-processes_created_by_netsh.md index 662d97698a..7b7f79645c 100644 --- a/docs/_posts/2020-11-23-processes_created_by_netsh.md +++ b/docs/_posts/2020-11-23-processes_created_by_netsh.md @@ -137,7 +137,7 @@ It is unusual for netsh.exe to have any child processes in most environments. It > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md index 7a67601eb1..e2c9aaaf5c 100644 --- a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md +++ b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md @@ -147,7 +147,7 @@ None identified > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md index c1fa093d80..14d83a388f 100644 --- a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md +++ b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md @@ -159,7 +159,7 @@ It is unusual for a service to be created or modified by directly manipulating t > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md index 240f39956d..bf5a4d23b9 100644 --- a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md +++ b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md @@ -151,7 +151,7 @@ Administrators may create jobs on systems forcing reboots to perform updates, ma > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-12-08-shim_database_file_creation.md b/docs/_posts/2020-12-08-shim_database_file_creation.md index e73f9f0b48..0ce6a8a469 100644 --- a/docs/_posts/2020-12-08-shim_database_file_creation.md +++ b/docs/_posts/2020-12-08-shim_database_file_creation.md @@ -146,7 +146,7 @@ Because legitimate shim files are created and used all the time, this event, in > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md index c8d86682bb..545bc9c5ad 100644 --- a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md +++ b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md @@ -149,7 +149,7 @@ Single-letter executables are not always malicious. Investigate this activity wi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md index 9af29366a3..6f18cf8b5a 100644 --- a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md +++ b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md @@ -115,9 +115,9 @@ During triage, review the parallel processes - what process moved the native Win #### Macros The SPL above uses the following Macros: +* [is_windows_system_file](https://github.com/splunk/security_content/blob/develop/macros/is_windows_system_file.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [is_windows_system_file](https://github.com/splunk/security_content/blob/develop/macros/is_windows_system_file.yml) > :information_source: > **system_processes_run_from_unexpected_locations_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -156,7 +156,7 @@ This detection may require tuning based on third party applications utilizing na > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-12-08-unusually_long_command_line.md b/docs/_posts/2020-12-08-unusually_long_command_line.md index 2bdfc98f68..a6874e39d2 100644 --- a/docs/_posts/2020-12-08-unusually_long_command_line.md +++ b/docs/_posts/2020-12-08-unusually_long_command_line.md @@ -142,7 +142,7 @@ Some legitimate applications start with long command lines. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md b/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md index 4747ad8212..c535fb14ae 100644 --- a/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md +++ b/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md @@ -156,7 +156,7 @@ Although unlikely, administrators may use event subscriptions for legitimate pur > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md index 374f9ef714..fd49f87ac7 100644 --- a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md +++ b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md @@ -143,7 +143,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md b/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md index f707e67d87..ee30a723f2 100644 --- a/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md +++ b/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md @@ -113,8 +113,8 @@ This search detects the assignment of rights to accesss content from another mai #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **o365_suspicious_rights_delegation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -145,7 +145,7 @@ Service Accounts > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md index 93dfbab852..8996475b29 100644 --- a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md +++ b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md @@ -150,7 +150,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-12-16-o365_pst_export_alert.md b/docs/_posts/2020-12-16-o365_pst_export_alert.md index 0c276f675c..4037093153 100644 --- a/docs/_posts/2020-12-16-o365_pst_export_alert.md +++ b/docs/_posts/2020-12-16-o365_pst_export_alert.md @@ -100,8 +100,8 @@ This search detects when a user has performed an Ediscovery search or exported a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **o365_pst_export_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -137,7 +137,7 @@ PST export can be done for legitimate purposes but due to the sensitive nature o > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md b/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md index 15694a1be7..24a14ff406 100644 --- a/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md +++ b/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md @@ -114,8 +114,8 @@ This search detects when an admin configured a forwarding rule for multiple mail #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **o365_suspicious_admin_email_forwarding_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -147,7 +147,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md b/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md index cb92c6b18f..46ed9198f8 100644 --- a/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md +++ b/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md @@ -114,8 +114,8 @@ This search detects when multiple user configured a forwarding rule to the same #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **o365_suspicious_user_email_forwarding_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -147,7 +147,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md index 5a9d88a047..9a0522dffa 100644 --- a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md +++ b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md @@ -142,7 +142,7 @@ Administrators may modify the boot configuration. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-06-supernova_webshell.md b/docs/_posts/2021-01-06-supernova_webshell.md index 8c445c81c2..a38fa3a6d2 100644 --- a/docs/_posts/2021-01-06-supernova_webshell.md +++ b/docs/_posts/2021-01-06-supernova_webshell.md @@ -146,7 +146,7 @@ There might be false positives associted with this detection since items like ar > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md index 3cd8b77e5d..7e569728b0 100644 --- a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md +++ b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md @@ -107,8 +107,8 @@ This search provides detection of KMS keys where action kms:Encrypt is accessibl #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -143,7 +143,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md index 209a2d62bd..94ca9fd7d9 100644 --- a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md +++ b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md @@ -101,8 +101,8 @@ This search provides detection of users with KMS keys performing encryption spec #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **aws_detect_users_with_kms_keys_performing_encryption_s3_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -138,7 +138,7 @@ bucket with S3 encryption > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md index 0430c95f8d..9c6b89bff6 100644 --- a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md +++ b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md @@ -114,8 +114,8 @@ The search looks for AWS CloudTrail events to detect if any network ACLs were cr #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **aws_network_access_control_list_created_with_all_open_ports_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -154,7 +154,7 @@ It's possible that an admin has created this ACL with all ports open for some le > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md index 9095ed0270..97fe890be8 100644 --- a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md +++ b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md @@ -111,8 +111,8 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **aws_network_access_control_list_deleted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -147,7 +147,7 @@ It's possible that a user has legitimately deleted a network ACL. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md index 2177b4bc10..56ad8afeab 100644 --- a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md +++ b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md @@ -150,7 +150,7 @@ Although unlikely, limited instances have been identified coming from native Mic > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md index 7b65d021db..980b6c1ff8 100644 --- a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md +++ b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md @@ -155,7 +155,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md index 89a76ca3e7..f837ac19d1 100644 --- a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md +++ b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md @@ -149,7 +149,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md index 387ba5dbc3..f3ff99120f 100644 --- a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md +++ b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md @@ -113,8 +113,8 @@ Malicious actors often abuse legitimate Dynamic DNS services to host malicious p #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [dynamic_dns_providers](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_providers.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [dynamic_dns_providers](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_providers.yml) > :information_source: > **detect_hosts_connecting_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -157,7 +157,7 @@ Some users and applications may leverage Dynamic DNS to reach out to some domain > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md index bd9b84ac59..d264511cc0 100644 --- a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md +++ b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md @@ -161,7 +161,7 @@ These characters might be legitimately on the command-line, but it is not common > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md b/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md index 619fc4e86f..f48bcf3d8c 100644 --- a/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md +++ b/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md @@ -143,7 +143,7 @@ Legitimate process can have this combination of command-line options, but it's n > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md index 47d043c3a9..3c942c3b56 100644 --- a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md +++ b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md @@ -156,7 +156,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md index d0b312eb27..80f40c2548 100644 --- a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md +++ b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md @@ -155,7 +155,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md index d664d5b08b..1a8acc8dc0 100644 --- a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md +++ b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md @@ -142,7 +142,7 @@ Administrators may modify the boot configuration. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md index 846b13e051..11ca52df26 100644 --- a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md +++ b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md @@ -103,8 +103,8 @@ This search provides specific SAML access from specific Service Provider, user a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **aws_saml_access_by_provider_user_and_principal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -141,7 +141,7 @@ Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very diff > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md index dc5e47487f..0573301025 100644 --- a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md +++ b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md @@ -103,8 +103,8 @@ This search provides detection of updates to SAML provider in AWS. Updates to SA #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **aws_saml_update_identity_provider_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -140,7 +140,7 @@ Updating a SAML provider or creating a new one may not necessarily be malicious > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md b/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md index 36d2feefe0..86e33ba13c 100644 --- a/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md +++ b/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md @@ -136,7 +136,7 @@ Unless there are specific use cases, manipulating or exporting certificates usin > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md index aea83fb679..4a121c7f70 100644 --- a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md +++ b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md @@ -136,7 +136,7 @@ None > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md index dcbb62614f..d93a66ab22 100644 --- a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md +++ b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md @@ -136,7 +136,7 @@ None > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md b/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md index 56115e9a35..d743ca3df3 100644 --- a/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md +++ b/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md @@ -105,8 +105,8 @@ This search detects the creation of a new Federation setting by alerting about a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **o365_add_app_role_assignment_grant_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -143,7 +143,7 @@ The creation of a new Federation is not necessarily malicious, however this even > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md b/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md index d4d8226a87..d5a0cd0982 100644 --- a/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md +++ b/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md @@ -103,8 +103,8 @@ This search detects accounts with high number of Single Sign ON (SSO) logon erro #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **o365_excessive_sso_logon_errors_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -139,7 +139,7 @@ Logon errors may not be malicious in nature however it may indicate attempts to > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-26-o365_new_federated_domain_added.md b/docs/_posts/2021-01-26-o365_new_federated_domain_added.md index 7f5a999c57..5c5fd9416e 100644 --- a/docs/_posts/2021-01-26-o365_new_federated_domain_added.md +++ b/docs/_posts/2021-01-26-o365_new_federated_domain_added.md @@ -105,8 +105,8 @@ This search detects the addition of a new Federated domain. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **o365_new_federated_domain_added_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -144,7 +144,7 @@ The creation of a new Federated domain is not necessarily malicious, however the > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-26-revil_registry_entry.md b/docs/_posts/2021-01-26-revil_registry_entry.md index 4f0943db57..443d184024 100644 --- a/docs/_posts/2021-01-26-revil_registry_entry.md +++ b/docs/_posts/2021-01-26-revil_registry_entry.md @@ -143,7 +143,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md index 1a8eb1b0ec..a8d7b373eb 100644 --- a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md +++ b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md @@ -140,7 +140,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md index 8133d978f0..7ec2bb2591 100644 --- a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md +++ b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md @@ -141,7 +141,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md index 439fe38455..af6f444458 100644 --- a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md +++ b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md @@ -157,7 +157,7 @@ Limited false positives related to third party software registering .DLL's. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md index fe50788ea2..c02bb291a8 100644 --- a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md +++ b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md @@ -153,7 +153,7 @@ Highly possible Server Administrators will troubleshoot with ntdsutil.exe, gener > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md index e359d35b62..ec20753b29 100644 --- a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md +++ b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md @@ -156,7 +156,7 @@ Limited false positives with the query restricted to specified paths. Add more w > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md index fec5bc362c..156896e442 100644 --- a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md +++ b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md @@ -143,7 +143,7 @@ If sudoedit is throwing segfaults for other reasons this will pick those up too. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md index 9f386c5152..f790f144d3 100644 --- a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md +++ b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md @@ -145,7 +145,7 @@ None identified. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md index acc307e278..106fba2a3a 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md @@ -155,7 +155,7 @@ Although unlikely, some legitimate applications may use advpack.dll or ieadvpack > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md index 7bc5cca6f8..1cda0b345e 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md @@ -155,7 +155,7 @@ Although unlikely, some legitimate applications may use setupapi triggering a fa > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md index 3a816b2d7a..ad8bac5f78 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md @@ -155,7 +155,7 @@ Although unlikely, some legitimate applications may use syssetup.dll, triggering > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md index 96be9a47d6..062103101d 100644 --- a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md +++ b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md @@ -156,7 +156,7 @@ Although unlikely, some legitimate applications may use Start as a function and > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md index 04f2adfb93..32fe627370 100644 --- a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md +++ b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md @@ -155,7 +155,7 @@ This is likely to produce false positives and will require some filtering. Tune > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md index 159f8fa6d9..3b86e6e0d0 100644 --- a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md +++ b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md @@ -154,7 +154,7 @@ Although unlikely, some legitimate applications (ex. web browsers) may spawn a c > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md index 9d0ebf91bf..f85e76b088 100644 --- a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md +++ b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md @@ -150,7 +150,7 @@ Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a fa > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md index 2a8a379e62..078a873546 100644 --- a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md +++ b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md @@ -151,7 +151,7 @@ Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a fa > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md index dbdcf8ff4e..e25de67624 100644 --- a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md +++ b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md @@ -142,7 +142,7 @@ Unknown. Filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md index 5de2b256eb..5e9fb637c6 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md @@ -155,7 +155,7 @@ Some legitimate applications may use PlistBuddy to create or modify property lis > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md index 974e87cf8e..28ad2b810c 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md @@ -143,7 +143,7 @@ Some legitimate applications may use PlistBuddy to create or modify property lis > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md index e6a1970067..2fcfb82b2f 100644 --- a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md +++ b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md @@ -141,7 +141,7 @@ Unknown. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md index 91529dda7f..4fca2c5b1d 100644 --- a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md +++ b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md @@ -157,7 +157,7 @@ Limited to no false positives are expected. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md index dece70ff7a..9050ba0148 100644 --- a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md +++ b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md @@ -145,7 +145,7 @@ Limited to no known false positives. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md index eb556f5990..0a2f0ff5d4 100644 --- a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md +++ b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md @@ -152,7 +152,7 @@ Limited false positives may be present. Filter as needed by parent process or co > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md index b76b821b3b..55f6c7f4ae 100644 --- a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md +++ b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md @@ -117,8 +117,8 @@ This search looks for AWS CloudTrail events where a user has set a default polic #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **aws_setdefaultpolicyversion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -152,7 +152,7 @@ While this search has no known false positives, it is possible that an AWS admin > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md index 0ec3fb86c5..b68b16519d 100644 --- a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md +++ b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md @@ -144,7 +144,7 @@ Unknown. Tune out child processes as needed to limit volume of false positives. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md index 688415c8ab..f86c4ee224 100644 --- a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md +++ b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md @@ -149,7 +149,7 @@ It is unusual to turn this feature off a Windows system since it is a default se > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md index d0e7a912b1..082d8597ae 100644 --- a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md +++ b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md @@ -149,7 +149,7 @@ Limited false positives may be present. Filter as needed based on initial analys > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-03-03-w3wp_spawning_shell.md b/docs/_posts/2021-03-03-w3wp_spawning_shell.md index 6726c5d15f..c476e2761e 100644 --- a/docs/_posts/2021-03-03-w3wp_spawning_shell.md +++ b/docs/_posts/2021-03-03-w3wp_spawning_shell.md @@ -116,10 +116,10 @@ This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **w3wp_spawning_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -161,7 +161,7 @@ Baseline your environment before production. It is possible build systems using > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md index 7aab4e59f6..18070e75e0 100644 --- a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md +++ b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md @@ -141,7 +141,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md index 25fcd9d035..d06ace054c 100644 --- a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md +++ b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md @@ -138,7 +138,7 @@ network admin can resize the shadowstorage for valid purposes. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-03-16-high_process_termination_frequency.md b/docs/_posts/2021-03-16-high_process_termination_frequency.md index 7e163a984d..d4cf37746f 100644 --- a/docs/_posts/2021-03-16-high_process_termination_frequency.md +++ b/docs/_posts/2021-03-16-high_process_termination_frequency.md @@ -137,7 +137,7 @@ admin or user tool that can terminate multiple process. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md index f0c1bee681..b73da35928 100644 --- a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md +++ b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md @@ -139,7 +139,7 @@ user may delete bunch of pictures or files in a folder. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-03-17-clop_common_exec_parameter.md b/docs/_posts/2021-03-17-clop_common_exec_parameter.md index ea8d3860ef..071a22bdd3 100644 --- a/docs/_posts/2021-03-17-clop_common_exec_parameter.md +++ b/docs/_posts/2021-03-17-clop_common_exec_parameter.md @@ -143,7 +143,7 @@ Operators can execute third party tools using these parameters. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md index ef67d8a565..0b7fdfe081 100644 --- a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md +++ b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md @@ -102,8 +102,8 @@ This detection is to identify the common service name created by the CLOP ransom #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **clop_ransomware_known_service_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -138,7 +138,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-03-23-certutil_with_decode_argument.md b/docs/_posts/2021-03-23-certutil_with_decode_argument.md index b296aab454..e492729dbd 100644 --- a/docs/_posts/2021-03-23-certutil_with_decode_argument.md +++ b/docs/_posts/2021-03-23-certutil_with_decode_argument.md @@ -102,9 +102,9 @@ CertUtil.exe may be used to `encode` and `decode` a file, including PE and scrip #### Macros The SPL above uses the following Macros: -* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) > :information_source: > **certutil_with_decode_argument_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -145,7 +145,7 @@ Typically seen used to `encode` files, but it is possible to see legitimate use > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md index 13954c7f7a..5583fced4f 100644 --- a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md +++ b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md @@ -145,7 +145,7 @@ Limited false positives. It is possible administrators will utilize Start-BitsTr > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md index cd57330b12..58cc4bc2de 100644 --- a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md +++ b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md @@ -110,8 +110,8 @@ The following query uses IAM events to track the success of a group being delete #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **aws_iam_successful_group_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -144,7 +144,7 @@ This detection will require tuning to provide high fidelity detection capabiltie > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md index 59afd63e06..50c84abe94 100644 --- a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md +++ b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md @@ -108,8 +108,8 @@ This search is to identifies suspicious firewall disabling using netsh applicati #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) > :information_source: > **disabling_firewall_with_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -149,7 +149,7 @@ admin may disable firewall during testing or fixing network problem. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-03-31-dsquery_domain_discovery.md b/docs/_posts/2021-03-31-dsquery_domain_discovery.md index b7f2076a28..5d78235363 100644 --- a/docs/_posts/2021-03-31-dsquery_domain_discovery.md +++ b/docs/_posts/2021-03-31-dsquery_domain_discovery.md @@ -145,7 +145,7 @@ Limited false positives. If there is a true false positive, filter based on comm > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md index 580660d873..eefad1135a 100644 --- a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md +++ b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md @@ -106,8 +106,8 @@ The following detection identifies any malformed policy document exceptions with #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **aws_iam_assume_role_policy_brute_force_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -140,7 +140,7 @@ This detection will require tuning to provide high fidelity detection capabiltie > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-01-aws_iam_delete_policy.md b/docs/_posts/2021-04-01-aws_iam_delete_policy.md index da5efa4654..d6f1902252 100644 --- a/docs/_posts/2021-04-01-aws_iam_delete_policy.md +++ b/docs/_posts/2021-04-01-aws_iam_delete_policy.md @@ -100,8 +100,8 @@ The following detection identifes when a policy is deleted on AWS. This does not #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **aws_iam_delete_policy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -134,7 +134,7 @@ This detection will require tuning to provide high fidelity detection capabiltie > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md index 9df4f77462..e260cd7bb3 100644 --- a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md +++ b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md @@ -100,8 +100,8 @@ This detection identifies failure attempts to delete groups. We want to identify #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **aws_iam_failure_group_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -134,7 +134,7 @@ This detection will require tuning to provide high fidelity detection capabiltie > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md index 81f481835a..ab261f4d7d 100644 --- a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md +++ b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md @@ -115,8 +115,8 @@ This detection is to identify the abuse the Windows SC.exe to execute malicious #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **malicious_powershell_executed_as_a_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -152,7 +152,7 @@ Creating a hidden powershell service is rare and could key off of those instance > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md b/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md index 907634a468..03972fab52 100644 --- a/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md +++ b/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md @@ -145,7 +145,7 @@ A host failing to authenticate with multiple valid domain users is not a common > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md index b793ff6484..6809b34a14 100644 --- a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md +++ b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md @@ -154,7 +154,7 @@ False positives are possible if legitimate applications are allowed to register > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-12-excel_spawning_powershell.md b/docs/_posts/2021-04-12-excel_spawning_powershell.md index 520f69b738..a7a8420e93 100644 --- a/docs/_posts/2021-04-12-excel_spawning_powershell.md +++ b/docs/_posts/2021-04-12-excel_spawning_powershell.md @@ -148,7 +148,7 @@ False positives should be limited, but if any are present, filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md index a8ca11ee8d..881449035a 100644 --- a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md +++ b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md @@ -143,7 +143,7 @@ False positives should be limited, but if any are present, filter as needed. In > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md index 680f07d746..fa288d86e1 100644 --- a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md +++ b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md @@ -151,7 +151,7 @@ False positives are possible if legitimate applications are allowed to register > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-12-winword_spawning_powershell.md b/docs/_posts/2021-04-12-winword_spawning_powershell.md index 4c34800f99..89a771922f 100644 --- a/docs/_posts/2021-04-12-winword_spawning_powershell.md +++ b/docs/_posts/2021-04-12-winword_spawning_powershell.md @@ -149,7 +149,7 @@ False positives should be limited, but if any are present, filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md index c77b993680..e7b23e671b 100644 --- a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md +++ b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md @@ -143,7 +143,7 @@ There will be limited false positives and it will be different for every environ > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md index 301ab592f9..630da0dd3c 100644 --- a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md +++ b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md @@ -107,8 +107,8 @@ This search looks for AWS CloudTrail events and analyse the amount of eventNames #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **aws_excessive_security_scanning_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -142,7 +142,7 @@ While this search has no known false positives. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md index 2b037a4659..ee94ae6d32 100644 --- a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md +++ b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md @@ -144,7 +144,7 @@ A host failing to authenticate with multiple valid domain users is not a common > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md index 91268fbb11..c6dacc87f6 100644 --- a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md +++ b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md @@ -149,7 +149,7 @@ A process failing to authenticate with multiple users is not a common behavior f > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md b/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md index 7be2868379..fcaf6e161c 100644 --- a/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md +++ b/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md @@ -147,7 +147,7 @@ A host failing to authenticate with multiple valid users against a remote host i > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md index 1bc12377f9..c8dc27db62 100644 --- a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md +++ b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md @@ -150,7 +150,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-13-windows_users_authenticate_using_explicit_credentials.md b/docs/_posts/2021-04-13-windows_users_authenticate_using_explicit_credentials.md index 410bc95cbb..eeeff83e47 100644 --- a/docs/_posts/2021-04-13-windows_users_authenticate_using_explicit_credentials.md +++ b/docs/_posts/2021-04-13-windows_users_authenticate_using_explicit_credentials.md @@ -148,7 +148,7 @@ A source user failing attempting to authenticate multiple users on a host is not > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md index 0c422c3296..bef8758516 100644 --- a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md +++ b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md @@ -144,7 +144,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-14-office_document_executing_macro_code.md b/docs/_posts/2021-04-14-office_document_executing_macro_code.md index a6683efdc2..eeb3ab4fee 100644 --- a/docs/_posts/2021-04-14-office_document_executing_macro_code.md +++ b/docs/_posts/2021-04-14-office_document_executing_macro_code.md @@ -146,7 +146,7 @@ Normal Office Document macro use for automation > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-14-windows_disabled_users_failing_to_authenticate_kerberos.md b/docs/_posts/2021-04-14-windows_disabled_users_failing_to_authenticate_kerberos.md index 1ca49d99f4..ea94b25366 100644 --- a/docs/_posts/2021-04-14-windows_disabled_users_failing_to_authenticate_kerberos.md +++ b/docs/_posts/2021-04-14-windows_disabled_users_failing_to_authenticate_kerberos.md @@ -145,7 +145,7 @@ A host failing to authenticate with multiple disabled domain users is not a comm > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-14-windows_invalid_users_failed_authentication_via_kerberos.md b/docs/_posts/2021-04-14-windows_invalid_users_failed_authentication_via_kerberos.md index 3ebbb93f72..565416e454 100644 --- a/docs/_posts/2021-04-14-windows_invalid_users_failed_authentication_via_kerberos.md +++ b/docs/_posts/2021-04-14-windows_invalid_users_failed_authentication_via_kerberos.md @@ -145,7 +145,7 @@ A host failing to authenticate with multiple invalid domain users is not a commo > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md index 01c1c0304c..b318ba8cc3 100644 --- a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md +++ b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md @@ -146,7 +146,7 @@ admin nslookup usage > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md b/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md index 7d74c0a930..f2c1f657ff 100644 --- a/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md +++ b/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md @@ -144,7 +144,7 @@ A host failing to authenticate with multiple invalid domain users is not a commo > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md index e826ac08dd..000c69e486 100644 --- a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md +++ b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md @@ -142,7 +142,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md index ad554eb7d0..3518e5e547 100644 --- a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md +++ b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md @@ -143,7 +143,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md index fb14fc0e43..323536440f 100644 --- a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md +++ b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md @@ -145,7 +145,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md b/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md index a109255d74..b78947071f 100644 --- a/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md +++ b/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md @@ -144,7 +144,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md index cc8ff1d2b6..caf4fa1b8e 100644 --- a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md +++ b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md @@ -137,7 +137,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md index b8cb036ecf..64a581ee32 100644 --- a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md +++ b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md @@ -102,10 +102,10 @@ This search is designed to detect suspicious cmd and powershell process spawned #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **wermgr_process_spawned_cmd_or_powershell_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -145,7 +145,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md b/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md index 60856b06d5..1220889852 100644 --- a/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md +++ b/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md @@ -142,7 +142,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md index dd6c352ef6..f787b8f414 100644 --- a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md +++ b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md @@ -149,7 +149,7 @@ Normal archive transfer via HTTP protocol may trip this detection. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md index 2562e52b6f..7d58b841d5 100644 --- a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md +++ b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md @@ -147,7 +147,7 @@ False positives should be limited as this behavior is not normal for `rundll32.e > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md index c42e3725da..fd3e25319c 100644 --- a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md +++ b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md @@ -149,7 +149,7 @@ False positives should be limited, but if any are present, filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md index 63247121eb..2f4662d6e8 100644 --- a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md +++ b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md @@ -143,7 +143,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-22-winword_spawning_cmd.md b/docs/_posts/2021-04-22-winword_spawning_cmd.md index 6b4bf9ddbc..cd8bc91dff 100644 --- a/docs/_posts/2021-04-22-winword_spawning_cmd.md +++ b/docs/_posts/2021-04-22-winword_spawning_cmd.md @@ -107,9 +107,9 @@ The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, #### Macros The SPL above uses the following Macros: +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **winword_spawning_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -149,7 +149,7 @@ False positives should be limited, but if any are present, filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md index 699d39c2af..83ac9784e0 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md +++ b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md @@ -149,7 +149,7 @@ No false positives known. Filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-26-office_product_spawning_certutil.md b/docs/_posts/2021-04-26-office_product_spawning_certutil.md index 6755b72727..a6c6750967 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_certutil.md +++ b/docs/_posts/2021-04-26-office_product_spawning_certutil.md @@ -107,9 +107,9 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: -* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) > :information_source: > **office_product_spawning_certutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -149,7 +149,7 @@ No false positives known. Filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-26-office_product_spawning_mshta.md b/docs/_posts/2021-04-26-office_product_spawning_mshta.md index e7f74b2c79..e1e4038175 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_mshta.md +++ b/docs/_posts/2021-04-26-office_product_spawning_mshta.md @@ -150,7 +150,7 @@ No false positives known. Filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-26-trickbot_named_pipe.md b/docs/_posts/2021-04-26-trickbot_named_pipe.md index a0bf8d31b5..cc29fc4eab 100644 --- a/docs/_posts/2021-04-26-trickbot_named_pipe.md +++ b/docs/_posts/2021-04-26-trickbot_named_pipe.md @@ -139,7 +139,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-29-icacls_deny_command.md b/docs/_posts/2021-04-29-icacls_deny_command.md index c730487f67..4eae75a7fe 100644 --- a/docs/_posts/2021-04-29-icacls_deny_command.md +++ b/docs/_posts/2021-04-29-icacls_deny_command.md @@ -138,7 +138,7 @@ Unknown. It is possible some administrative scripts use ICacls. Filter as needed > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md index 3088a7f722..ff1e142ac3 100644 --- a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md +++ b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md @@ -144,7 +144,7 @@ Limited false positives will be present. Some applications do load drivers > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-04-29-xmrig_driver_loaded.md b/docs/_posts/2021-04-29-xmrig_driver_loaded.md index 8740d183c4..7046351428 100644 --- a/docs/_posts/2021-04-29-xmrig_driver_loaded.md +++ b/docs/_posts/2021-04-29-xmrig_driver_loaded.md @@ -144,7 +144,7 @@ False positives should be limited. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-05-04-deleting_of_net_users.md b/docs/_posts/2021-05-04-deleting_of_net_users.md index 0cd8ac9cac..2d513333bd 100644 --- a/docs/_posts/2021-05-04-deleting_of_net_users.md +++ b/docs/_posts/2021-05-04-deleting_of_net_users.md @@ -144,7 +144,7 @@ System administrators or scripts may delete user accounts via this technique. Fi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-05-04-disabling_net_user_account.md b/docs/_posts/2021-05-04-disabling_net_user_account.md index 2869992e52..5d3c6378ba 100644 --- a/docs/_posts/2021-05-04-disabling_net_user_account.md +++ b/docs/_posts/2021-05-04-disabling_net_user_account.md @@ -144,7 +144,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md index eab11f7911..b09ec6c2e0 100644 --- a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md +++ b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md @@ -139,7 +139,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md index f4014dad41..3dec5b2e36 100644 --- a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md +++ b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md @@ -146,7 +146,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md index b821c331a6..58d25495b2 100644 --- a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md +++ b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md @@ -144,7 +144,7 @@ Unknown. Filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-05-04-icacls_grant_command.md b/docs/_posts/2021-05-04-icacls_grant_command.md index 47be477d95..01c62fcfba 100644 --- a/docs/_posts/2021-05-04-icacls_grant_command.md +++ b/docs/_posts/2021-05-04-icacls_grant_command.md @@ -139,7 +139,7 @@ Unknown. Filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md index a64dd21bac..bbecb9975f 100644 --- a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md +++ b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md @@ -107,9 +107,9 @@ The following analytic identifies the use of `wmic.exe` using `delete` to remove #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) > :information_source: > **process_kill_base_on_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -149,7 +149,7 @@ Unknown. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-05-05-suspicious_process_file_path.md b/docs/_posts/2021-05-05-suspicious_process_file_path.md index d8c0ac37c5..aea34adffa 100644 --- a/docs/_posts/2021-05-05-suspicious_process_file_path.md +++ b/docs/_posts/2021-05-05-suspicious_process_file_path.md @@ -146,7 +146,7 @@ Administrators may allow execution of specific binaries in non-standard paths. F > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-05-06-download_files_using_telegram.md b/docs/_posts/2021-05-06-download_files_using_telegram.md index 682927bf6c..43eaa37a0b 100644 --- a/docs/_posts/2021-05-06-download_files_using_telegram.md +++ b/docs/_posts/2021-05-06-download_files_using_telegram.md @@ -137,7 +137,7 @@ normal download of file in telegram app. (if it was a common app in network) > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md index b358ad0c56..04879af5f4 100644 --- a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md +++ b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md @@ -140,7 +140,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md index b88806c5cf..2b90be4869 100644 --- a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md +++ b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md @@ -146,7 +146,7 @@ unknown. Filter as needed. Modify the time span as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md index 0976f518ee..349ae29be9 100644 --- a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md +++ b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md @@ -143,7 +143,7 @@ Administrators may allow creation of script or exe in the paths specified. Filte > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md index ef65642160..7a6bc74726 100644 --- a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md +++ b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md @@ -139,7 +139,7 @@ Administrators or administrative scripts may use this application. Filter as nee > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md index 0b96c2a762..9e8d148a76 100644 --- a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md +++ b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md @@ -141,7 +141,7 @@ Administrators may use to debug Schedule Task entries. Filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md b/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md index b93e66fd34..cdb6bd5506 100644 --- a/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md +++ b/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md @@ -101,8 +101,8 @@ This following analytic detects PowerShell command to delete shadow copy using t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **delete_shadowcopy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -137,7 +137,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md index 33a2cc048e..64ff8b9995 100644 --- a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md +++ b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md @@ -144,7 +144,7 @@ Legitimate windows application that are not on the list loading this dll. Filter > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-05-13-slui_runas_elevated.md b/docs/_posts/2021-05-13-slui_runas_elevated.md index f38abdf792..6f128776c8 100644 --- a/docs/_posts/2021-05-13-slui_runas_elevated.md +++ b/docs/_posts/2021-05-13-slui_runas_elevated.md @@ -147,7 +147,7 @@ Limited false positives should be present as this is not commonly used by legiti > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-05-13-slui_spawning_a_process.md b/docs/_posts/2021-05-13-slui_spawning_a_process.md index 06cc4721f7..ec237144a1 100644 --- a/docs/_posts/2021-05-13-slui_spawning_a_process.md +++ b/docs/_posts/2021-05-13-slui_spawning_a_process.md @@ -147,7 +147,7 @@ Certain applications may spawn from `slui.exe` that are legitimate. Filtering wi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-05-18-services_escalate_exe.md b/docs/_posts/2021-05-18-services_escalate_exe.md index 50363a5f52..47924bf50c 100644 --- a/docs/_posts/2021-05-18-services_escalate_exe.md +++ b/docs/_posts/2021-05-18-services_escalate_exe.md @@ -140,7 +140,7 @@ False positives should be limited as `services.exe` should never spawn a process > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md b/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md index b0d8da0519..f8d18f858e 100644 --- a/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md +++ b/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md @@ -106,8 +106,8 @@ The following analytic identifies suspicious PowerShell command to allow inbound #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **allow_inbound_traffic_in_firewall_rule_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -140,7 +140,7 @@ administrator may allow inbound traffic in certain network or machine. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-05-19-mailsniper_invoke_functions.md b/docs/_posts/2021-05-19-mailsniper_invoke_functions.md index 43d6819934..e5e1267fc9 100644 --- a/docs/_posts/2021-05-19-mailsniper_invoke_functions.md +++ b/docs/_posts/2021-05-19-mailsniper_invoke_functions.md @@ -106,8 +106,8 @@ This search is to detect known mailsniper.ps1 functions executed in a machine. T #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **mailsniper_invoke_functions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -140,7 +140,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md index c8cfde7233..c32f863108 100644 --- a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md +++ b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md @@ -119,9 +119,9 @@ This analytic identifies a common behavior by Cobalt Strike and other frameworks #### Macros The SPL above uses the following Macros: +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **cmd_echo_pipe_-_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -161,7 +161,7 @@ Unknown. It is possible filtering may be required to ensure fidelity. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-05-21-winrm_spawning_a_process.md b/docs/_posts/2021-05-21-winrm_spawning_a_process.md index a4280d98c0..f941292f1b 100644 --- a/docs/_posts/2021-05-21-winrm_spawning_a_process.md +++ b/docs/_posts/2021-05-21-winrm_spawning_a_process.md @@ -147,7 +147,7 @@ Unknown. Add new processes or filter as needed. It is possible system management > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md index a55645df3e..42ee811fe0 100644 --- a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md +++ b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md @@ -145,7 +145,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md index e9dcade39a..f6da8244e1 100644 --- a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md +++ b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md @@ -168,7 +168,7 @@ False positives should be limited as the analytic is specific to a filename with > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-05-27-detect_sharphound_usage.md b/docs/_posts/2021-05-27-detect_sharphound_usage.md index 3f6e2dac8b..3fe7723c86 100644 --- a/docs/_posts/2021-05-27-detect_sharphound_usage.md +++ b/docs/_posts/2021-05-27-detect_sharphound_usage.md @@ -174,7 +174,7 @@ False positives should be limited as this is specific to a file attribute not us > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md index 9dd15a69d0..93e1e6b5cc 100644 --- a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md +++ b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md @@ -173,7 +173,7 @@ Unknown. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md index f31dcdbdac..b9c6d7610e 100644 --- a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md +++ b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md @@ -167,7 +167,7 @@ False positives should be limited as the analytic is specific to a filename with > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md index 905a6d655d..efc68eb9c4 100644 --- a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md +++ b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md @@ -170,7 +170,7 @@ False positives should be limited as the arguments used are specific to SharpHou > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-02-conti_common_exec_parameter.md b/docs/_posts/2021-06-02-conti_common_exec_parameter.md index 7e145b9580..316ee41a9b 100644 --- a/docs/_posts/2021-06-02-conti_common_exec_parameter.md +++ b/docs/_posts/2021-06-02-conti_common_exec_parameter.md @@ -143,7 +143,7 @@ To successfully implement this search, you need to be ingesting logs with the pr > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-02-modification_of_wallpaper.md b/docs/_posts/2021-06-02-modification_of_wallpaper.md index 01632e648e..bb4baa84c7 100644 --- a/docs/_posts/2021-06-02-modification_of_wallpaper.md +++ b/docs/_posts/2021-06-02-modification_of_wallpaper.md @@ -142,7 +142,7 @@ To successfully implement this search, you need to be ingesting logs with the Im > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-02-revil_common_exec_parameter.md b/docs/_posts/2021-06-02-revil_common_exec_parameter.md index 56a282977d..333cfb289a 100644 --- a/docs/_posts/2021-06-02-revil_common_exec_parameter.md +++ b/docs/_posts/2021-06-02-revil_common_exec_parameter.md @@ -141,7 +141,7 @@ third party tool may have same command line parameters as revil ransomware. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md index 4f4b0b7bcd..aa6d560171 100644 --- a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md +++ b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md @@ -146,7 +146,7 @@ legitimate process that are not in the exception list may trigger this event. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md index b24cf8cb2c..3c01acc3b9 100644 --- a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md +++ b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md @@ -101,8 +101,8 @@ This search detects a suspicioous termination of known services killed by ransom #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **known_services_killed_by_ransomware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -136,7 +136,7 @@ Admin activities or installing related updates may do a sudden stop to list of s > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md index 40bb9be438..21bfada3a3 100644 --- a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md +++ b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md @@ -141,7 +141,7 @@ Administrators, administrative actions or certain applications may run many inst > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md b/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md index 8c8f19e96e..98ba72fb42 100644 --- a/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md +++ b/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md @@ -114,8 +114,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_fileless_process_injection_via_getprocaddress_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -150,7 +150,7 @@ Limited false positives. Filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md b/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md index fec77a66ff..c538fe2b26 100644 --- a/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md +++ b/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md @@ -113,8 +113,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_fileless_script_contains_base64_encoded_content_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -149,7 +149,7 @@ False positives should be limited. Filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md b/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md index bab04b8013..fa15056f8b 100644 --- a/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md +++ b/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md @@ -107,8 +107,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_empire_with_powershell_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -143,7 +143,7 @@ False positives may only pertain to it not being related to Empire, but another > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md b/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md index a44d983520..b7dc1c284f 100644 --- a/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md +++ b/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md @@ -102,8 +102,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_mimikatz_with_powershell_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -138,7 +138,7 @@ False positives should be limited as the commands being identifies are quite spe > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md index a04804d565..793f8550d3 100644 --- a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md +++ b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md @@ -112,8 +112,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **unloading_amsi_via_reflection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -148,7 +148,7 @@ Potential for some third party applications to disable AMSI upon invocation. Fil > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md index eda019d148..262e1b6bf6 100644 --- a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md +++ b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md @@ -148,7 +148,7 @@ administrator may execute this app to manage disk > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md index 8008a7681c..0ea696d65d 100644 --- a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md +++ b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md @@ -145,7 +145,7 @@ network operator may disable audit event logs for debugging purposes. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md index 418a531564..d895f70a46 100644 --- a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md +++ b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md @@ -140,7 +140,7 @@ takeown.exe is a normal windows application that may used by network operator. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md b/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md index 339783be67..6c6cf0c524 100644 --- a/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md +++ b/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md @@ -105,8 +105,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_creating_thread_mutex_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -139,7 +139,7 @@ powershell developer may used this function in their script for instance checkin > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-10-powershell_domain_enumeration.md b/docs/_posts/2021-06-10-powershell_domain_enumeration.md index 12f0f3cdd7..ddf93250e3 100644 --- a/docs/_posts/2021-06-10-powershell_domain_enumeration.md +++ b/docs/_posts/2021-06-10-powershell_domain_enumeration.md @@ -107,8 +107,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_domain_enumeration_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -141,7 +141,7 @@ It is possible there will be false positives, filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md b/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md index 6bfed2dc83..22736ee8b4 100644 --- a/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md +++ b/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md @@ -107,8 +107,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_loading_dotnet_into_memory_via_reflection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -143,7 +143,7 @@ False positives should be limited as day to day scripts do not use this method. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md b/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md index ebd8c6f395..4653bf74ad 100644 --- a/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md +++ b/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md @@ -105,8 +105,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_processing_stream_of_data_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -141,7 +141,7 @@ powershell may used this function to process compressed data. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md index 0651e952bb..63c2fafb1b 100644 --- a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md +++ b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md @@ -140,7 +140,7 @@ Administrators may modify the boot configuration ignore failure during testing a > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-10-recon_using_wmi_class.md b/docs/_posts/2021-06-10-recon_using_wmi_class.md index fa334abcc4..4c8d730be6 100644 --- a/docs/_posts/2021-06-10-recon_using_wmi_class.md +++ b/docs/_posts/2021-06-10-recon_using_wmi_class.md @@ -100,8 +100,8 @@ The following analytic identifies suspicious PowerShell via EventCode 4104, wher #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **recon_using_wmi_class_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -136,7 +136,7 @@ network administrator may used this command for checking purposes > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md b/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md index f9e3ae5126..35dc4c2b53 100644 --- a/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md +++ b/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md @@ -100,8 +100,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **wmi_recon_running_process_or_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -135,7 +135,7 @@ network administrator may used this command for checking purposes > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md index bab259528f..72713207b3 100644 --- a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md +++ b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md @@ -145,7 +145,7 @@ It is possible some applications will create a consumer and may be required to b > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md index 60c4dcf63e..ff2ea0cea2 100644 --- a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md +++ b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md @@ -149,7 +149,7 @@ It is possible the Event Logging service gets shut down due to system errors or > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md index f3cb3bed6f..f41f7f15d2 100644 --- a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md +++ b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md @@ -144,7 +144,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md b/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md index 1385bccfb1..85426be232 100644 --- a/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md +++ b/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md @@ -106,8 +106,8 @@ This search is to detect a suspicious enabling of smb1protocol through "powershe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_enable_smb1protocol_feature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -142,7 +142,7 @@ network operator may enable or disable this windows feature. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md index 632ad32f31..eb65981ea1 100644 --- a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md +++ b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md @@ -107,9 +107,9 @@ This search is to detect a suspicious commandline designed to delete files or di #### Macros The SPL above uses the following Macros: +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **recursive_delete_of_directory_in_batch_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -149,7 +149,7 @@ network operator may use this batch command to delete recursively a directory or > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md index 7c8f2f14f3..0c89987a33 100644 --- a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md +++ b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md @@ -108,8 +108,8 @@ This search is to detect a suspicious modification of firewall to allow file and #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) > :information_source: > **allow_file_and_printing_sharing_in_firewall_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -149,7 +149,7 @@ network admin may modify this firewall feature that may cause this rule to be tr > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md index ae402378ab..6993027c8a 100644 --- a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md +++ b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md @@ -108,8 +108,8 @@ This search is to detect a suspicious modification to the firewall to allow netw #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) > :information_source: > **allow_network_discovery_in_firewall_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -150,7 +150,7 @@ network admin may modify this firewall feature that may cause this rule to be tr > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md index 733a0bca06..849bccd29b 100644 --- a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md +++ b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md @@ -144,7 +144,7 @@ excessive execution of sc.exe is quite suspicious since it can modify or execute > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md index 5b8f314df8..ef62d7eafc 100644 --- a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md +++ b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md @@ -145,7 +145,7 @@ Legitimate programs and administrators will execute sc.exe with the start disabl > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md index 990135e899..a0f829606a 100644 --- a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md +++ b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md @@ -117,8 +117,8 @@ During triage, isolate the endpoint and review for source of exploitation. Captu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **print_spooler_adding_a_printer_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -151,7 +151,7 @@ Unknown. This may require filtering. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md index 0de92d6264..d5094a4a8e 100644 --- a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md +++ b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md @@ -118,8 +118,8 @@ During triage, isolate the endpoint and review for source of exploitation. Captu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **print_spooler_failed_to_load_a_plug-in_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -152,7 +152,7 @@ False positives are unknown and filtering may be required. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md index 2707a2c100..ec07f63c94 100644 --- a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md +++ b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md @@ -156,7 +156,7 @@ Limited false positives have been identified. There are limited instances where > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md index 4875b9c09f..cb2ac3bed0 100644 --- a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md +++ b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md @@ -148,7 +148,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md index e245f2c50b..a22067412c 100644 --- a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md +++ b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md @@ -141,7 +141,7 @@ Unknown. Filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md index 6f69208348..4f210180e0 100644 --- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md +++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md @@ -155,7 +155,7 @@ Unknown. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md index be0e7e75cd..72cefff943 100644 --- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md +++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md @@ -149,7 +149,7 @@ Limited false positives. Filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md index d679943795..d736ada874 100644 --- a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md +++ b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md @@ -147,7 +147,7 @@ quite minimal false positive expected. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md index df90b856a6..324bc9edb8 100644 --- a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md +++ b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md @@ -150,7 +150,7 @@ Limited false positives. However, tune based on scripts that may perform this ac > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md index 0b6c27f90e..c9f070f3ec 100644 --- a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md +++ b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md @@ -146,7 +146,7 @@ unknown. all of the dll loaded by mmc.exe is microsoft signed dll. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md index eaaa7fc201..9c8e890bd2 100644 --- a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md +++ b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md @@ -161,7 +161,7 @@ It's possible that a user will start to create compute instances for the first t > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-19-aws_createloginprofile.md b/docs/_posts/2021-07-19-aws_createloginprofile.md index 3d6e1cf3a4..395fb43b45 100644 --- a/docs/_posts/2021-07-19-aws_createloginprofile.md +++ b/docs/_posts/2021-07-19-aws_createloginprofile.md @@ -116,8 +116,8 @@ This search looks for AWS CloudTrail events where a user A(victim A) creates a l #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **aws_createloginprofile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -150,7 +150,7 @@ While this search has no known false positives, it is possible that an AWS admin > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md index 255cfa8075..d7b9b393f5 100644 --- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md +++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md @@ -115,8 +115,8 @@ This search looks for AWS CloudTrail events where a user has created an open/pub #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_new_open_s3_buckets_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -153,7 +153,7 @@ While this search has no known false positives, it is possible that an AWS admin > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md index b117399a0e..e8abc8052d 100644 --- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md +++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md @@ -108,8 +108,8 @@ This search looks for AWS CloudTrail events where a user has created an open/pub #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_new_open_s3_buckets_over_aws_cli_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -149,7 +149,7 @@ While this search has no known false positives, it is possible that an AWS admin > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md index 3e3fcac19b..bc64df7088 100644 --- a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md +++ b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md @@ -152,7 +152,7 @@ limitted. this anomaly behavior is not commonly seen in clean host. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md index 780879b255..1a8abd0c7d 100644 --- a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md +++ b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md @@ -107,9 +107,9 @@ this search is to detect a suspicious office product process that spawn cmd chil #### Macros The SPL above uses the following Macros: +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **office_product_spawn_cmd_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -149,7 +149,7 @@ IT or network admin may create an document automation that will run shell script > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md b/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md index 8a85473aad..257563c8b2 100644 --- a/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md +++ b/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md @@ -145,7 +145,7 @@ It is possible that an AWS admin has legitimately shared a snapshot with others > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md b/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md index 961789757b..1f08a24b4d 100644 --- a/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md +++ b/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md @@ -112,8 +112,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_copy_of_shadowcopy_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -147,7 +147,7 @@ Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hive > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-23-sam_database_file_access_attempt.md b/docs/_posts/2021-07-23-sam_database_file_access_attempt.md index d3624aa126..d9c2d32959 100644 --- a/docs/_posts/2021-07-23-sam_database_file_access_attempt.md +++ b/docs/_posts/2021-07-23-sam_database_file_access_attempt.md @@ -142,7 +142,7 @@ Natively, `dllhost.exe` will access the files. Every environment will have addit > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md index f58d7c25f2..7ee60a9e83 100644 --- a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md +++ b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md @@ -140,7 +140,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md index 993cddca30..2fee621286 100644 --- a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md +++ b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md @@ -142,7 +142,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md index 3f9df63f45..9264ea657c 100644 --- a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md +++ b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md @@ -150,7 +150,7 @@ limitted. this parameter is not commonly used by windows application but can be > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md index 177bc415ac..e63dc15bff 100644 --- a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md +++ b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md @@ -149,7 +149,7 @@ third party application may used this dll export name to execute function. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-27-chcp_command_execution.md b/docs/_posts/2021-07-27-chcp_command_execution.md index 41dea20230..e779aef587 100644 --- a/docs/_posts/2021-07-27-chcp_command_execution.md +++ b/docs/_posts/2021-07-27-chcp_command_execution.md @@ -140,7 +140,7 @@ other tools or script may used this to change code page to UTF-* or others > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md index 2e3b898fa8..72410a121d 100644 --- a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md +++ b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md @@ -154,7 +154,7 @@ minimal. but network operator can use this application to load dll. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md index 362a49e360..fdf4ec8c06 100644 --- a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md +++ b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md @@ -140,7 +140,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-30-drop_icedid_license_dat.md b/docs/_posts/2021-07-30-drop_icedid_license_dat.md index 6947deb0b4..35acb6bef9 100644 --- a/docs/_posts/2021-07-30-drop_icedid_license_dat.md +++ b/docs/_posts/2021-07-30-drop_icedid_license_dat.md @@ -136,7 +136,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md index b2ae22d47e..7ee2b55ee4 100644 --- a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md +++ b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md @@ -141,7 +141,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md index 4ea62893dc..a4b6fb562c 100644 --- a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md +++ b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md @@ -149,7 +149,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md index 56eefd871f..e3ec1efb85 100644 --- a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md +++ b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md @@ -136,7 +136,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md index 29c7c303cc..bf0db94672 100644 --- a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md +++ b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md @@ -139,7 +139,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md index ab143a2843..9da25e52ad 100644 --- a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md +++ b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md @@ -145,7 +145,7 @@ unknown. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-11-fsutil_zeroing_file.md b/docs/_posts/2021-08-11-fsutil_zeroing_file.md index ed61f1ec08..d250310e6a 100644 --- a/docs/_posts/2021-08-11-fsutil_zeroing_file.md +++ b/docs/_posts/2021-08-11-fsutil_zeroing_file.md @@ -138,7 +138,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md index e392129664..65a9387f53 100644 --- a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md +++ b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md @@ -143,7 +143,7 @@ not so common. but 3rd part app may load this dll. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md b/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md index b08be20bfd..1bb1a670db 100644 --- a/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md +++ b/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md @@ -149,7 +149,7 @@ network admin or normal user may share files to customer and external team. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md index febbd50d89..3c41a25ed8 100644 --- a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md +++ b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md @@ -107,8 +107,8 @@ This search is to detect a suspicious attachment file extension in Gsuite email #### Macros The SPL above uses the following Macros: -* [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) > :information_source: > **gsuite_email_suspicious_attachment_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -145,7 +145,7 @@ network admin and normal user may send this file attachment as part of their day > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md index 2afe23010a..e9fe2ca201 100644 --- a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md +++ b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md @@ -145,7 +145,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md index e1da50fddc..9564e9e876 100644 --- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md +++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md @@ -119,8 +119,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **aws_ecr_container_scanning_findings_high_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -157,7 +157,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md index 718480f17c..8bda2214bc 100644 --- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md +++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md @@ -119,8 +119,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **aws_ecr_container_scanning_findings_low_informational_unknown_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -157,7 +157,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md index 391be517c1..0b4f00180d 100644 --- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md +++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md @@ -119,8 +119,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **aws_ecr_container_scanning_findings_medium_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -157,7 +157,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md index 2ad0c1e6d9..a5d581a73a 100644 --- a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md +++ b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md @@ -112,8 +112,8 @@ This search is to detect a suspicious outbound e-mail from internal email to ext #### Macros The SPL above uses the following Macros: -* [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) > :information_source: > **gsuite_outbound_email_with_attachment_to_external_domain_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -143,7 +143,7 @@ network admin and normal user may send this file attachment as part of their day > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-18-esentutl_sam_copy.md b/docs/_posts/2021-08-18-esentutl_sam_copy.md index 3e485afea0..119d3124c1 100644 --- a/docs/_posts/2021-08-18-esentutl_sam_copy.md +++ b/docs/_posts/2021-08-18-esentutl_sam_copy.md @@ -107,9 +107,9 @@ The following analytic identifies the process - `esentutl.exe` - being used to c #### Macros The SPL above uses the following Macros: +* [process_esentutl](https://github.com/splunk/security_content/blob/develop/macros/process_esentutl.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_esentutl](https://github.com/splunk/security_content/blob/develop/macros/process_esentutl.yml) > :information_source: > **esentutl_sam_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -150,7 +150,7 @@ False positives should be limited. Filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-18-powershell_4104_hunting.md b/docs/_posts/2021-08-18-powershell_4104_hunting.md index 219aefe986..64c961091d 100644 --- a/docs/_posts/2021-08-18-powershell_4104_hunting.md +++ b/docs/_posts/2021-08-18-powershell_4104_hunting.md @@ -310,7 +310,7 @@ Limited false positives. May filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md index b17517c6c9..7a1ef37c9a 100644 --- a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md +++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md @@ -115,8 +115,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **aws_ecr_container_upload_outside_business_hours_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -153,7 +153,7 @@ When your development is spreaded in different time zones, applying this rule ca > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md index 06cd8ffc15..50136f2f48 100644 --- a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md +++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md @@ -115,9 +115,9 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [aws_ecr_users](https://github.com/splunk/security_content/blob/develop/macros/aws_ecr_users.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **aws_ecr_container_upload_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -154,7 +154,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md index a12eb88c2b..dee1311390 100644 --- a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md +++ b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md @@ -110,8 +110,8 @@ This search is to detect a gsuite email contains suspicious subject having known #### Macros The SPL above uses the following Macros: -* [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) > :information_source: > **gsuite_email_suspicious_subject_with_attachment_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -140,7 +140,7 @@ normal user or normal transaction may contain the subject and file type attachme > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md index fe24c22ef8..cd7873937d 100644 --- a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md +++ b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md @@ -141,7 +141,7 @@ Some networks may use kerberized FTP or telnet servers, however, this is rare. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-20-github_commit_changes_in_master.md b/docs/_posts/2021-08-20-github_commit_changes_in_master.md index 45fc019461..0db42eec42 100644 --- a/docs/_posts/2021-08-20-github_commit_changes_in_master.md +++ b/docs/_posts/2021-08-20-github_commit_changes_in_master.md @@ -131,7 +131,7 @@ admin can do changes directly to master branch > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md index a57a6286ea..d467a3d42a 100644 --- a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md +++ b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md @@ -148,7 +148,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md index 6f4e1e443f..55b0cd8cf1 100644 --- a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md +++ b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md @@ -137,7 +137,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md index 37b775da8a..65ed551ddb 100644 --- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md +++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md @@ -137,7 +137,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md index aa74fdd0d4..6a544a3ab2 100644 --- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md +++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getwmiobject_user_account_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -134,7 +134,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md index 068bd0ccde..b9eae53195 100644 --- a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md +++ b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md @@ -110,8 +110,8 @@ This analytics is to detect a gmail containing a link that are known to be abuse #### Macros The SPL above uses the following Macros: -* [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) > :information_source: > **gsuite_email_with_known_abuse_web_service_link_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -140,7 +140,7 @@ normal email contains this link that are known application within the organizati > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md b/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md index f58bbdb3e4..29b055c896 100644 --- a/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md +++ b/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md @@ -148,7 +148,7 @@ normal user or normal transaction may contain the subject and file type attachme > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md index abc9e85d93..d62060e513 100644 --- a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md +++ b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md @@ -143,7 +143,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md index b6db865c9e..ea9a9b6194 100644 --- a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md +++ b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **adsisearcher_account_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -140,7 +140,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md index 6f5fb9b8f6..6161794c2a 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md @@ -145,7 +145,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md index b8fbf4fb1d..68b6e25aab 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md @@ -146,7 +146,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md index 717081311d..0f8edcb217 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md @@ -145,7 +145,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md index 35bb1f0ef5..1c692cdaee 100644 --- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md +++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md @@ -143,7 +143,7 @@ Limited false positives as this requires an active Administrator or adversary to > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md index 70a156d87f..05ece5ca7d 100644 --- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md @@ -102,8 +102,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **get-domaintrust_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -138,7 +138,7 @@ It is possible certain system management frameworks utilize this command to gath > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell.md b/docs/_posts/2021-08-24-get_aduser_with_powershell.md index 8eaf88a876..99d7a6b93d 100644 --- a/docs/_posts/2021-08-24-get_aduser_with_powershell.md +++ b/docs/_posts/2021-08-24-get_aduser_with_powershell.md @@ -145,7 +145,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md b/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md index 9620e03b45..2885ec9bca 100644 --- a/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **get_aduser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -139,7 +139,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md index e5da98060b..5e3ccc9ec7 100644 --- a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md +++ b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md @@ -145,7 +145,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md index 8a33e69b41..12ffa406ce 100644 --- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md +++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md @@ -145,7 +145,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md index 7187d4584c..c090f4f54a 100644 --- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getwmiobject_ds_user_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -139,7 +139,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md index 7de89a590d..db880108c1 100644 --- a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md +++ b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md @@ -147,7 +147,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md b/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md index 03b2aed80b..56e7aa0105 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **domain_group_discovery_with_adsisearcher_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -138,7 +138,7 @@ Administrators or power users may use Adsisearcher for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md index 00b79fcfc2..aa06e4111a 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md @@ -147,7 +147,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md index cfe1fbe893..53315ed956 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md @@ -147,7 +147,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md index 7a98b87ff9..eb3df3262c 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md @@ -147,7 +147,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md index 2def8308ba..95bcfb93d3 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **elevated_group_discovery_with_powerview_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -138,7 +138,7 @@ Administrators or power users may use this PowerView for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md index 765e6a564e..289891f3b1 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md @@ -147,7 +147,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-25-getadgroup_with_powershell.md b/docs/_posts/2021-08-25-getadgroup_with_powershell.md index d93a9301f1..78d29754ca 100644 --- a/docs/_posts/2021-08-25-getadgroup_with_powershell.md +++ b/docs/_posts/2021-08-25-getadgroup_with_powershell.md @@ -147,7 +147,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md index d7c7fd7844..bd53c4c7a6 100644 --- a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md +++ b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md @@ -147,7 +147,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md index ba119b23d5..ad340cae7a 100644 --- a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md +++ b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md @@ -142,7 +142,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md index 6579964100..4ec21d1676 100644 --- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md +++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md @@ -147,7 +147,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md index 2c52556a68..52ea5b8660 100644 --- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md +++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getwmiobject_ds_group_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -138,7 +138,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md index 5b591105ca..b95ef0b2e8 100644 --- a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md @@ -140,7 +140,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md index c66a73593d..2e9ec509b7 100644 --- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md @@ -140,7 +140,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md index 7eac273df6..ff79a04102 100644 --- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md @@ -100,8 +100,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **get_aduserresultantpasswordpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -134,7 +134,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md index cdf024c7a6..68210802d9 100644 --- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md @@ -140,7 +140,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md index da99cc07c8..ee64ac4113 100644 --- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md @@ -100,8 +100,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **get_domainpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -134,7 +134,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md b/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md index 253b326e7e..545ab393fc 100644 --- a/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getdomaingroup_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -138,7 +138,7 @@ Administrators or power users may use this PowerView functions for troubleshooti > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md index 53025e09c9..7f195b6c3d 100644 --- a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md +++ b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md @@ -140,7 +140,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md index 7630a9e43e..b15a922a25 100644 --- a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md +++ b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md @@ -158,7 +158,7 @@ This detection should yield little or no false positive results. It is uncommon > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md index 2d8c8c72d3..27495bc909 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md +++ b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md @@ -141,7 +141,7 @@ Limited false positives, however, tune as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md index c6df2cf778..38f8098ad8 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md +++ b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md @@ -111,8 +111,8 @@ Module - New-managementroleassignment can assign a management role to a manageme #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **exchange_powershell_module_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -147,7 +147,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md index 5b5fec4020..a7a7709f4a 100644 --- a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md +++ b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md @@ -142,7 +142,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md index 71ee65d8a8..933e997068 100644 --- a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md +++ b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md @@ -142,7 +142,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md index 3404818a3e..7ae0dd38c1 100644 --- a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md +++ b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md @@ -144,7 +144,7 @@ False positives have been limited when the Anonymous Logon is used for Account N > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md index 952eae11b7..639b6ff4aa 100644 --- a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md +++ b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md @@ -141,7 +141,7 @@ False positives are possible if the environment is using certificates for authen > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md index d91097e2a6..1526c5c5e8 100644 --- a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md +++ b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md @@ -142,7 +142,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-01-circle_ci_disable_security_step.md b/docs/_posts/2021-09-01-circle_ci_disable_security_step.md index 93b01d25c8..9e27a6d39f 100644 --- a/docs/_posts/2021-09-01-circle_ci_disable_security_step.md +++ b/docs/_posts/2021-09-01-circle_ci_disable_security_step.md @@ -152,7 +152,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md index 9b9ad568fc..6158e6df76 100644 --- a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md +++ b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md @@ -142,7 +142,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md index 116d42da37..9534f2d6fd 100644 --- a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md +++ b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md @@ -147,7 +147,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md index 7509d69ecc..9f6011c46d 100644 --- a/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getadcomputer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -133,7 +133,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md index 0c33804148..9ef16fa75a 100644 --- a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getwmiobject_ds_computer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -133,7 +133,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-01-github_commit_in_develop.md b/docs/_posts/2021-09-01-github_commit_in_develop.md index 90b7ec16d5..e2886e38e9 100644 --- a/docs/_posts/2021-09-01-github_commit_in_develop.md +++ b/docs/_posts/2021-09-01-github_commit_in_develop.md @@ -131,7 +131,7 @@ admin can do changes directly to develop branch > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-01-github_dependabot_alert.md b/docs/_posts/2021-09-01-github_dependabot_alert.md index ef6c0a97c2..8e071247fe 100644 --- a/docs/_posts/2021-09-01-github_dependabot_alert.md +++ b/docs/_posts/2021-09-01-github_dependabot_alert.md @@ -154,7 +154,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md index a81f49a45b..85e105186d 100644 --- a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md +++ b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md @@ -156,7 +156,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md b/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md index 49786f72ab..f62c1c6ce5 100644 --- a/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md +++ b/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **remote_system_discovery_with_adsisearcher_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -133,7 +133,7 @@ Administrators or power users may use Adsisearcher for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md index 2cfdf7f113..d2cbc9336e 100644 --- a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md +++ b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md @@ -142,7 +142,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-02-circle_ci_disable_security_job.md b/docs/_posts/2021-09-02-circle_ci_disable_security_job.md index 067c7bf271..735373a9e4 100644 --- a/docs/_posts/2021-09-02-circle_ci_disable_security_job.md +++ b/docs/_posts/2021-09-02-circle_ci_disable_security_job.md @@ -148,7 +148,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md index b146442398..dfa36ed572 100644 --- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md +++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md @@ -143,7 +143,7 @@ Limited false positives as this requires an active Administrator or adversary to > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md index ecfdb52b71..6004b1416c 100644 --- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md @@ -102,8 +102,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **get-foresttrust_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -138,7 +138,7 @@ False positives may be present. Tune as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md b/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md index a213227ba0..f35dfdad93 100644 --- a/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getdomaincomputer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -133,7 +133,7 @@ Administrators or power users may use PowerView for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md b/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md index dcd3098cfb..6438259673 100644 --- a/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getdomaincontroller_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -133,7 +133,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md index e61e6e5eb5..ac2289bd7c 100644 --- a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md +++ b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md @@ -138,7 +138,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md index 7ab1cfc5c2..fda1a61b06 100644 --- a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md +++ b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md @@ -138,7 +138,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md b/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md index 14a1b75ef4..8cd918eff2 100644 --- a/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md +++ b/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md @@ -141,7 +141,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-06-correlation_by_user_and_risk.md b/docs/_posts/2021-09-06-correlation_by_user_and_risk.md index b7adb3f7aa..8fc54dfbb0 100644 --- a/docs/_posts/2021-09-06-correlation_by_user_and_risk.md +++ b/docs/_posts/2021-09-06-correlation_by_user_and_risk.md @@ -141,7 +141,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md index 621cc8f160..90bf4429ed 100644 --- a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md +++ b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md @@ -142,7 +142,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md index 6a94a8d6cb..713fbc5000 100644 --- a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md +++ b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md @@ -142,7 +142,7 @@ Administrators or power users may use PowerView for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md index 952e9e8c86..d908a9d014 100644 --- a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md +++ b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md @@ -142,7 +142,7 @@ Administrators or power users may use PowerView for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md index 537f1f127e..fb7d6d46cf 100644 --- a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md +++ b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md @@ -142,7 +142,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md index 200fd6b378..5f1e7fe3f7 100644 --- a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md +++ b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md @@ -142,7 +142,7 @@ normal application like mmc.exe and other ldap query tool may trigger this detec > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-07-system_information_discovery_detection.md b/docs/_posts/2021-09-07-system_information_discovery_detection.md index 24fc781d70..a1f26d2874 100644 --- a/docs/_posts/2021-09-07-system_information_discovery_detection.md +++ b/docs/_posts/2021-09-07-system_information_discovery_detection.md @@ -144,7 +144,7 @@ Administrators debugging servers > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md index c251ac64b1..594531298f 100644 --- a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md +++ b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md @@ -153,7 +153,7 @@ Limited false positives will be present as control.exe does not natively load fr > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md index 2c4d2ec4df..d82a61ca56 100644 --- a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md +++ b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md @@ -153,7 +153,7 @@ Administrators often leverage net.exe to create admin accounts. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-08-office_spawning_control.md b/docs/_posts/2021-09-08-office_spawning_control.md index 9a8b99ba29..aec0d7cc2e 100644 --- a/docs/_posts/2021-09-08-office_spawning_control.md +++ b/docs/_posts/2021-09-08-office_spawning_control.md @@ -153,7 +153,7 @@ Limited false positives should be present. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md index b6e0e42549..8b8a3ff9c7 100644 --- a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md +++ b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md @@ -155,7 +155,7 @@ This is a hunting detection, meant to provide a understanding of how voluminous > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md index f4b7ec665a..b9e405aef2 100644 --- a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md +++ b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md @@ -155,7 +155,7 @@ This may be tuned, or a new one related, by adding .cpl to command-line. However > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-09-extraction_of_registry_hives.md b/docs/_posts/2021-09-09-extraction_of_registry_hives.md index 22abd57cc3..a39d5f8422 100644 --- a/docs/_posts/2021-09-09-extraction_of_registry_hives.md +++ b/docs/_posts/2021-09-09-extraction_of_registry_hives.md @@ -150,7 +150,7 @@ It is possible some agent based products will generate false positives. Filter a > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md b/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md index 2a16daca8c..283e5188e6 100644 --- a/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md +++ b/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md @@ -148,7 +148,7 @@ Limited false positives will be present, however, tune as necessary. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md b/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md index c4e393c123..9cbc7d7180 100644 --- a/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md +++ b/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getnettcpconnection_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -133,7 +133,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md index e83cd8566e..c89ce7ea75 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md @@ -142,7 +142,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md index 0dfd1f7aef..309880bcb5 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md @@ -142,7 +142,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md index d7b499849c..02afe963b8 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md @@ -142,7 +142,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md b/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md index 146ce8c0c3..285f6b2960 100644 --- a/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md +++ b/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md @@ -152,7 +152,7 @@ The query is structured in a way that `action` (read, create) is not defined. Re > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md index 4427baae72..7e6072e5ca 100644 --- a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md +++ b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md @@ -143,7 +143,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md index a8d7d0fbe8..8ffd3e7b82 100644 --- a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md +++ b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md @@ -145,7 +145,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md index d99bf67cc0..3b0d396361 100644 --- a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md +++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md @@ -143,7 +143,7 @@ automation scripting language may used by network operator to do ldap query. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md index 101685c5f7..d0dc7976de 100644 --- a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md +++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md @@ -143,7 +143,7 @@ automation scripting language may used by network operator to do ldap query. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-13-office_application_drop_executable.md b/docs/_posts/2021-09-13-office_application_drop_executable.md index 4b6ace04ab..eed3ff9e9e 100644 --- a/docs/_posts/2021-09-13-office_application_drop_executable.md +++ b/docs/_posts/2021-09-13-office_application_drop_executable.md @@ -147,7 +147,7 @@ office macro for automation may do this behavior > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_query.md b/docs/_posts/2021-09-13-system_user_discovery_with_query.md index 52d1d9bbf0..3d5f542883 100644 --- a/docs/_posts/2021-09-13-system_user_discovery_with_query.md +++ b/docs/_posts/2021-09-13-system_user_discovery_with_query.md @@ -143,7 +143,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md index 416f13a02d..6c269f5979 100644 --- a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md +++ b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md @@ -143,7 +143,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md index d2f95d0594..52e651933e 100644 --- a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md +++ b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md @@ -143,7 +143,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md index 157935ec84..7799ae5de6 100644 --- a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md +++ b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md @@ -102,9 +102,9 @@ This search is to detect a suspicious wmic.exe process or renamed wmic process t #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) > :information_source: > **xsl_script_execution_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -141,7 +141,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md index aa3d6cc99c..d1a4c191e5 100644 --- a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md +++ b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md @@ -148,7 +148,7 @@ A network operator or systems administrator may utilize an automated host discov > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md index 1f2b2ba75d..0c112c1c9b 100644 --- a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md +++ b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md @@ -148,7 +148,7 @@ False positives may be present. Tune as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-14-net_localgroup_discovery.md b/docs/_posts/2021-09-14-net_localgroup_discovery.md index 98acc74924..c71e0bfd9a 100644 --- a/docs/_posts/2021-09-14-net_localgroup_discovery.md +++ b/docs/_posts/2021-09-14-net_localgroup_discovery.md @@ -149,7 +149,7 @@ False positives may be present. Tune as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md index 3f8a0e3b86..d1cfcb3cc0 100644 --- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md +++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md @@ -148,7 +148,7 @@ False positives may be present. Tune as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md index 8a1f66a49e..96189c8f79 100644 --- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md +++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md @@ -107,8 +107,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_get_localgroup_discovery_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -141,7 +141,7 @@ False positives may be present. Tune as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-14-wmic_group_discovery.md b/docs/_posts/2021-09-14-wmic_group_discovery.md index 82c7650aeb..4934e04504 100644 --- a/docs/_posts/2021-09-14-wmic_group_discovery.md +++ b/docs/_posts/2021-09-14-wmic_group_discovery.md @@ -150,7 +150,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md index bcf8148dee..694618f1b7 100644 --- a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md +++ b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md @@ -139,7 +139,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md index 29bdd7ab70..d8ee054155 100644 --- a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md +++ b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md @@ -146,7 +146,7 @@ other browser not listed related to firefox may catch by this rule. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md index 3c40aaaf61..a2d1d3b7c1 100644 --- a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md +++ b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md @@ -146,7 +146,7 @@ other browser not listed related to firefox may catch by this rule. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-16-account_discovery_with_net_app.md b/docs/_posts/2021-09-16-account_discovery_with_net_app.md index 730ab62d84..aebb4338a1 100644 --- a/docs/_posts/2021-09-16-account_discovery_with_net_app.md +++ b/docs/_posts/2021-09-16-account_discovery_with_net_app.md @@ -151,7 +151,7 @@ admin or power user may used this series of command. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md index 634afec4b1..fb65fae26a 100644 --- a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md +++ b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md @@ -116,9 +116,9 @@ Attempt To Add Certificate To Untrusted Store #### Macros The SPL above uses the following Macros: -* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) > :information_source: > **attempt_to_add_certificate_to_untrusted_store_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -155,7 +155,7 @@ There may be legitimate reasons for administrators to add a certificate to the u > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md index 0ce7794c62..43ce2e7a48 100644 --- a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md +++ b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md @@ -113,9 +113,9 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th #### Macros The SPL above uses the following Macros: +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) > :information_source: @@ -159,7 +159,7 @@ None identified. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-16-batch_file_write_to_system32.md b/docs/_posts/2021-09-16-batch_file_write_to_system32.md index 4539e6212c..160222e305 100644 --- a/docs/_posts/2021-09-16-batch_file_write_to_system32.md +++ b/docs/_posts/2021-09-16-batch_file_write_to_system32.md @@ -152,7 +152,7 @@ It is possible for this search to generate a notable event for a batch file writ > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-16-bits_job_persistence.md b/docs/_posts/2021-09-16-bits_job_persistence.md index 7d7cb5605e..1de2af652c 100644 --- a/docs/_posts/2021-09-16-bits_job_persistence.md +++ b/docs/_posts/2021-09-16-bits_job_persistence.md @@ -146,7 +146,7 @@ Limited false positives will be present. Typically, applications will use `BitsA > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-16-bitsadmin_download_file.md b/docs/_posts/2021-09-16-bitsadmin_download_file.md index 9886644f77..d2c8c7bf2d 100644 --- a/docs/_posts/2021-09-16-bitsadmin_download_file.md +++ b/docs/_posts/2021-09-16-bitsadmin_download_file.md @@ -153,7 +153,7 @@ Limited false positives, however it may be required to filter based on parent pr > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md index b771571417..7b9f556da7 100644 --- a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md +++ b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md @@ -112,9 +112,9 @@ This search detects the use of wmic and Powershell to create a shadow copy. #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: @@ -156,7 +156,7 @@ Legtimate administrator usage of wmic to create a shadow copy. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md index 92974311a8..dcf5dcfcc6 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md @@ -112,9 +112,9 @@ This search detects credential dumping using copy command from a shadow copy. #### Macros The SPL above uses the following Macros: +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **credential_dumping_via_copy_command_from_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -154,7 +154,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md index 580f8d08a6..07f3c1ee10 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md @@ -112,9 +112,9 @@ This search detects the creation of a symlink to a shadow copy. #### Macros The SPL above uses the following Macros: +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **credential_dumping_via_symlink_to_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -154,7 +154,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md index f8be9cf371..68d5bbbde4 100644 --- a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md @@ -112,9 +112,9 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_html_help_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -155,7 +155,7 @@ Although unlikely, some legitimate applications may retrieve a CHM remotely, fil > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md index db81e9d010..6aab4f0981 100644 --- a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md +++ b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md @@ -112,9 +112,9 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_html_help_using_infotech_storage_handlers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -155,7 +155,7 @@ It is rare to see instances of InfoTech Storage Handlers being used, but it does > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md index 646ceb31a7..778d8b6ff4 100644 --- a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md +++ b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md @@ -155,7 +155,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md index 2c475a64e0..7ec5743895 100644 --- a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md @@ -155,7 +155,7 @@ It is possible legitimate applications may perform this behavior and will need t > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md index 9789c28914..1dea81ca3d 100644 --- a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md +++ b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md @@ -158,7 +158,7 @@ Administrators can leverage PsExec for accessing remote systems and might pass ` > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-16-detect_renamed_7-zip.md b/docs/_posts/2021-09-16-detect_renamed_7-zip.md index 6cf4262a27..2aa3a5d738 100644 --- a/docs/_posts/2021-09-16-detect_renamed_7-zip.md +++ b/docs/_posts/2021-09-16-detect_renamed_7-zip.md @@ -148,7 +148,7 @@ Limited false positives, however this analytic will need to be modified for each > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-16-detect_renamed_rclone.md b/docs/_posts/2021-09-16-detect_renamed_rclone.md index f2e57e8149..05f75b217e 100644 --- a/docs/_posts/2021-09-16-detect_renamed_rclone.md +++ b/docs/_posts/2021-09-16-detect_renamed_rclone.md @@ -143,7 +143,7 @@ False positives should be limited as this analytic identifies renamed instances > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-16-detect_renamed_winrar.md b/docs/_posts/2021-09-16-detect_renamed_winrar.md index 0c7e7aa0d1..e0a0dee5d6 100644 --- a/docs/_posts/2021-09-16-detect_renamed_winrar.md +++ b/docs/_posts/2021-09-16-detect_renamed_winrar.md @@ -148,7 +148,7 @@ Unknown. It is possible third party applications use renamed instances of WinRAR > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md index 4a5fa98e9a..cbd7f74e6d 100644 --- a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md +++ b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md @@ -114,8 +114,8 @@ During triage, confirm this is procdump.exe executing. If it is the first time a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_procdump](https://github.com/splunk/security_content/blob/develop/macros/process_procdump.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: @@ -153,7 +153,7 @@ None identified. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_net.md b/docs/_posts/2021-09-16-local_account_discovery_with_net.md index ae109b8453..f4b3227e0b 100644 --- a/docs/_posts/2021-09-16-local_account_discovery_with_net.md +++ b/docs/_posts/2021-09-16-local_account_discovery_with_net.md @@ -138,7 +138,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md index 93b346f94f..34a3d5138b 100644 --- a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md +++ b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md @@ -107,9 +107,9 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) > :information_source: > **local_account_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -138,7 +138,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-16-office_product_spawning_wmic.md b/docs/_posts/2021-09-16-office_product_spawning_wmic.md index e633470995..eed2b96620 100644 --- a/docs/_posts/2021-09-16-office_product_spawning_wmic.md +++ b/docs/_posts/2021-09-16-office_product_spawning_wmic.md @@ -107,9 +107,9 @@ The following detection identifies the latest behavior utilized by Ursnif malwar #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) > :information_source: > **office_product_spawning_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -150,7 +150,7 @@ No false positives known. Filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-16-processes_launching_netsh.md b/docs/_posts/2021-09-16-processes_launching_netsh.md index f97c6caf50..0e1481ce2f 100644 --- a/docs/_posts/2021-09-16-processes_launching_netsh.md +++ b/docs/_posts/2021-09-16-processes_launching_netsh.md @@ -113,8 +113,8 @@ This search looks for processes launching netsh.exe. Netsh is a command-line scr #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) > :information_source: > **processes_launching_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -151,7 +151,7 @@ Some VPN applications are known to launch netsh.exe. Outside of these instances, > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md index 171dba2732..cab0d16a04 100644 --- a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md +++ b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md @@ -148,7 +148,7 @@ Default browser not in the filter list. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md index e4ccf99289..b2b27c06ed 100644 --- a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md +++ b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md @@ -136,7 +136,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md b/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md index a9bff0a438..dec00ec226 100644 --- a/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md +++ b/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md @@ -140,7 +140,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md b/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md index e201b94ed1..12b1983e5f 100644 --- a/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md +++ b/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md @@ -140,7 +140,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-27-change_default_file_association.md b/docs/_posts/2021-09-27-change_default_file_association.md index d41d8d6193..cb7c02689c 100644 --- a/docs/_posts/2021-09-27-change_default_file_association.md +++ b/docs/_posts/2021-09-27-change_default_file_association.md @@ -147,7 +147,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md index 0292c54669..c65717412e 100644 --- a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md +++ b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md @@ -146,7 +146,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md index 3a59bbf0df..b84ed3e5c4 100644 --- a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md +++ b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md @@ -147,7 +147,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-28-print_processor_registry_autostart.md b/docs/_posts/2021-09-28-print_processor_registry_autostart.md index 9f78548a3a..d0cbefcb3b 100644 --- a/docs/_posts/2021-09-28-print_processor_registry_autostart.md +++ b/docs/_posts/2021-09-28-print_processor_registry_autostart.md @@ -148,7 +148,7 @@ possible new printer installation may add driver component on this registry. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-09-29-verclsid_clsid_execution.md b/docs/_posts/2021-09-29-verclsid_clsid_execution.md index e0c80c97f6..be4fd3f7ba 100644 --- a/docs/_posts/2021-09-29-verclsid_clsid_execution.md +++ b/docs/_posts/2021-09-29-verclsid_clsid_execution.md @@ -108,8 +108,8 @@ This analytic is to detect a possible abuse of verclsid to execute malicious fil #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_verclsid](https://github.com/splunk/security_content/blob/develop/macros/process_verclsid.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_verclsid](https://github.com/splunk/security_content/blob/develop/macros/process_verclsid.yml) > :information_source: > **verclsid_clsid_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -149,7 +149,7 @@ windows can used this application for its normal COM object validation. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md index 2f4712acc7..e3c8f76556 100644 --- a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md +++ b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md @@ -149,7 +149,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md index 4a130ec3ef..2d634ce925 100644 --- a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md +++ b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md @@ -144,7 +144,7 @@ False positives should be limited as developers do not spawn MSBuild via a WSH. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md index 7ab016e37d..f67fb16893 100644 --- a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md +++ b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md @@ -155,7 +155,7 @@ Other third part application may used this parameter but not so common in base w > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-10-05-detect_exchange_web_shell.md b/docs/_posts/2021-10-05-detect_exchange_web_shell.md index 64a4f4bb66..e35e09eb0c 100644 --- a/docs/_posts/2021-10-05-detect_exchange_web_shell.md +++ b/docs/_posts/2021-10-05-detect_exchange_web_shell.md @@ -151,7 +151,7 @@ The query is structured in a way that `action` (read, create) is not defined. Re > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md index c92dd507b1..f72b3e29df 100644 --- a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md +++ b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md @@ -149,7 +149,7 @@ False positives should be limited, filter as needed. In our test case, Remcos us > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md index 694d3b6d87..f42d4979d5 100644 --- a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md +++ b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md @@ -148,7 +148,7 @@ False positives should be limited, however it is possible to filter by Processes > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md index bdc14982b0..f7e4a6b192 100644 --- a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md +++ b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md @@ -145,7 +145,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md index af63f529d2..2de92d79aa 100644 --- a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md +++ b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md @@ -149,7 +149,7 @@ every user may do this event but very un-ussual. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md index fde853a427..0fbefce559 100644 --- a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md +++ b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md @@ -144,7 +144,7 @@ False positives should be limited as winhlp32.exe is typically not used with the > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md b/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md index 7072ad7733..cc36c5840d 100644 --- a/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md +++ b/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md @@ -153,7 +153,7 @@ It's possible there can be long domain names that are legitimate. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-10-06-sdelete_application_execution.md b/docs/_posts/2021-10-06-sdelete_application_execution.md index 959a2f8873..d81e1b179e 100644 --- a/docs/_posts/2021-10-06-sdelete_application_execution.md +++ b/docs/_posts/2021-10-06-sdelete_application_execution.md @@ -154,7 +154,7 @@ user may execute and use this application > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md index cec7e8608e..238d194fdd 100644 --- a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md +++ b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md @@ -165,7 +165,7 @@ Administrators may create vbs or js script that use several tool as part of its > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md index 01e8f5d298..762e377e0f 100644 --- a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md +++ b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md @@ -155,7 +155,7 @@ The wevtutil.exe application is a legitimate Windows event log utility. Administ > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md index 7d8a265fee..c6a43b9ce7 100644 --- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md +++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md @@ -104,8 +104,8 @@ During triage, review parallel processes for further suspicious activity. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **serviceprincipalnames_discovery_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -146,7 +146,7 @@ False positives should be limited, however filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md index e51d62326e..28feffa6ea 100644 --- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md +++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md @@ -152,7 +152,7 @@ False positives may be caused by Administrators resetting SPNs or querying for S > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-10-18-disable_schedule_task.md b/docs/_posts/2021-10-18-disable_schedule_task.md index b3fc9ce166..1b4cfa60ad 100644 --- a/docs/_posts/2021-10-18-disable_schedule_task.md +++ b/docs/_posts/2021-10-18-disable_schedule_task.md @@ -142,7 +142,7 @@ admin may disable problematic schedule task > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md index 75b21d520d..0285716fab 100644 --- a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md +++ b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md @@ -105,8 +105,8 @@ During triage, review parallel processes for further behavior. In addition, iden #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml) > :information_source: > **windows_curl_download_to_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -147,7 +147,7 @@ It is possible Administrators or super users will use Curl for legitimate purpos > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md b/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md index dd3314e445..d893b1bbd3 100644 --- a/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md +++ b/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md @@ -141,7 +141,7 @@ False positives will be present. Filter based on ActionName paths or specify key > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md b/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md index aaa3c6c1e5..12dc7340c3 100644 --- a/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md +++ b/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md @@ -148,7 +148,7 @@ third party application may use this approach to uninstall there application > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md b/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md index ee1b9b343c..985dd92032 100644 --- a/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md +++ b/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md @@ -138,7 +138,7 @@ This is an anomaly search, you must specify your domain in the parameters so it > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md b/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md index 05fa8f1fd1..c93b5532ac 100644 --- a/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md +++ b/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md @@ -137,7 +137,7 @@ This search will also produce normal activity statistics. Fields such as email, > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-03-windows_adfind_exe.md b/docs/_posts/2021-11-03-windows_adfind_exe.md index ae27f6c24e..bd276cdce8 100644 --- a/docs/_posts/2021-11-03-windows_adfind_exe.md +++ b/docs/_posts/2021-11-03-windows_adfind_exe.md @@ -145,7 +145,7 @@ administrators rarely use adfind, usually not used for legitimate reasons > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md b/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md index f1d5e42897..fd0857c133 100644 --- a/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md +++ b/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md @@ -167,7 +167,7 @@ Some administrator activity can be potentially triggered, please add those users > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md index d15ce784b4..ab3efa98b0 100644 --- a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md +++ b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md @@ -107,8 +107,8 @@ Adversaries may use one of the three methods based on the remote destination and #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml) > :information_source: > **windows_curl_upload_to_remote_destination_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -148,7 +148,7 @@ False positives may be limited to source control applications and may be require > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md index 5da833e578..be55e557b9 100644 --- a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md +++ b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md @@ -150,7 +150,7 @@ Administrators may create Windows Services on remote systems, but this activity > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md index cbc8075766..30f8951fe7 100644 --- a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md +++ b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md @@ -150,7 +150,7 @@ Administrators may start Windows Services on remote systems, but this activity i > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md index b076df1d77..4adbe759e9 100644 --- a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md +++ b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md @@ -148,7 +148,7 @@ Administrators may leverage WinRM and WinRs to start a process on remote systems > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md index 87e1989c94..9efa6c3b0c 100644 --- a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md +++ b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md @@ -153,7 +153,7 @@ Administrators may create scheduled tasks on remote systems, but this activity i > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md index 8594dd3d1e..8f7eb63971 100644 --- a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md +++ b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md @@ -153,7 +153,7 @@ Administrators may start scheduled tasks on remote systems, but this activity is > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md index 4486bf3aa2..3e2d9784e0 100644 --- a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md +++ b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md @@ -102,9 +102,9 @@ The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible St #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) > :information_source: > **wmic_xsl_execution_via_url_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -144,7 +144,7 @@ False positives are limited as legitimate applications typically do not download > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md b/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md index 3dae7a3ebd..6e3ae286d2 100644 --- a/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md +++ b/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md @@ -102,8 +102,8 @@ The following detection identifies excessive AccessDenied events within an hour #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **aws_iam_accessdenied_discovery_events_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -137,7 +137,7 @@ It is possible to start this detection will need to be tuned by source IP or use > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md index 6b95e7c65b..e393521d7a 100644 --- a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md +++ b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md @@ -108,8 +108,8 @@ this analytic is to detect a suspicious compile before delivery approach of .net #### Macros The SPL above uses the following Macros: * [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **csc_net_on_the_fly_compilation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -146,7 +146,7 @@ A network operator or systems administrator may utilize an automated powershell > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-12-firewall_allowed_program_enable.md b/docs/_posts/2021-11-12-firewall_allowed_program_enable.md index 51fc80ad1b..53ded3f04c 100644 --- a/docs/_posts/2021-11-12-firewall_allowed_program_enable.md +++ b/docs/_posts/2021-11-12-firewall_allowed_program_enable.md @@ -145,7 +145,7 @@ A network operator or systems administrator may utilize an automated or manual e > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md index 51716ce843..971dd3bbde 100644 --- a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md +++ b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md @@ -108,8 +108,8 @@ This analytic look for a spawned process of route.exe windows application. Adver #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_route](https://github.com/splunk/security_content/blob/develop/macros/process_route.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_route](https://github.com/splunk/security_content/blob/develop/macros/process_route.yml) > :information_source: > **network_discovery_using_route_windows_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -146,7 +146,7 @@ A network operator or systems administrator may utilize an automated host discov > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md index ebc2459ed9..59357aa8f6 100644 --- a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md +++ b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md @@ -110,9 +110,9 @@ This analytic identifies wmic.exe being launched with parameters to spawn a proc #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) > :information_source: > **remote_process_instantiation_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -154,7 +154,7 @@ The wmic.exe utility is a benign Windows application. It may be used legitimatel > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-12-runas_execution_in_commandline.md b/docs/_posts/2021-11-12-runas_execution_in_commandline.md index 8d93a290a6..44ab86c0bc 100644 --- a/docs/_posts/2021-11-12-runas_execution_in_commandline.md +++ b/docs/_posts/2021-11-12-runas_execution_in_commandline.md @@ -109,9 +109,9 @@ This analytic look for a spawned runas.exe process with a administrator user opt #### Macros The SPL above uses the following Macros: +* [process_runas](https://github.com/splunk/security_content/blob/develop/macros/process_runas.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_runas](https://github.com/splunk/security_content/blob/develop/macros/process_runas.yml) > :information_source: > **runas_execution_in_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -149,7 +149,7 @@ A network operator or systems administrator may utilize an automated or manual e > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-12-windows_installutil_credential_theft.md b/docs/_posts/2021-11-12-windows_installutil_credential_theft.md index 27158377d4..baa1e11f26 100644 --- a/docs/_posts/2021-11-12-windows_installutil_credential_theft.md +++ b/docs/_posts/2021-11-12-windows_installutil_credential_theft.md @@ -151,7 +151,7 @@ Typically this will not trigger as by it's very nature InstallUtil does not need > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md index 6034d0ff53..55bc046bbd 100644 --- a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md +++ b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md @@ -111,9 +111,9 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: +* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) > :information_source: > **windows_installutil_uninstall_option_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -154,7 +154,7 @@ Limited false positives should be present. Filter as needed by parent process or > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md index 31931f9bdd..c2736e0ce1 100644 --- a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md +++ b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md @@ -110,9 +110,9 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: +* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) > :information_source: > **windows_installutil_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -153,7 +153,7 @@ Limited false positives should be present as InstallUtil is not typically used t > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md index 66a651a0c7..37b92ca050 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md @@ -149,7 +149,7 @@ Administrators may leverage DCOM to start a process on remote systems, but this > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md index e60efaba09..133e5e5ae1 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md @@ -144,7 +144,7 @@ Administrators may leverage WWMI and powershell.exe to start a process on remote > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md index 757fbfe201..b8856a3372 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **remote_process_instantiation_via_wmi_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -133,7 +133,7 @@ Administrators may leverage WWMI and powershell.exe to start a process on remote > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-15-windows_diskcryptor_usage.md b/docs/_posts/2021-11-15-windows_diskcryptor_usage.md index 22e2d22d41..9d36129ad0 100644 --- a/docs/_posts/2021-11-15-windows_diskcryptor_usage.md +++ b/docs/_posts/2021-11-15-windows_diskcryptor_usage.md @@ -143,7 +143,7 @@ It is possible false positives may be present based on the internal name dcinst. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md b/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md index ac222ae88d..98131b04cf 100644 --- a/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md +++ b/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md @@ -142,7 +142,7 @@ this behavior may seen in normal transfer of file within network if network shar > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md index b888da59c0..d611b7f432 100644 --- a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md +++ b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md @@ -149,7 +149,7 @@ Administrators may leverage WinRM and `Invoke-Command` to start a process on rem > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-17-windows_dism_remove_defender.md b/docs/_posts/2021-11-17-windows_dism_remove_defender.md index 8284fef570..407e0e576c 100644 --- a/docs/_posts/2021-11-17-windows_dism_remove_defender.md +++ b/docs/_posts/2021-11-17-windows_dism_remove_defender.md @@ -148,7 +148,7 @@ Some legitimate administrative tools leverage `dism.exe` to manipulate packages > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md index 33e561285b..04a37eba8b 100644 --- a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md +++ b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md @@ -147,7 +147,7 @@ System Administrators may use looks like PsExec for troubleshooting or administr > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md index 3ae1f562ee..ab844da06b 100644 --- a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md +++ b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md @@ -147,7 +147,7 @@ False positives should be limited, however it is possible to filter by Processes > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md index e331263a76..139b376069 100644 --- a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md +++ b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md @@ -102,9 +102,9 @@ This analytic is to detect a suspicious dxdiag.exe process command-line executio #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_dxdiag](https://github.com/splunk/security_content/blob/develop/macros/process_dxdiag.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **system_info_gathering_using_dxdiag_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -144,7 +144,7 @@ This commandline can be used by a network administrator to audit host machine sp > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md index caf3384e1f..a240857b3c 100644 --- a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md +++ b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md @@ -148,7 +148,7 @@ False positive is quite limited. Filter is needed > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md index 7bd3bee68c..f1d26ef0d2 100644 --- a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md @@ -151,7 +151,7 @@ Legitimate applications may trigger this behavior, filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md index 34e506259e..49d8668e14 100644 --- a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md @@ -153,7 +153,7 @@ Legitimate applications may trigger this behavior, filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md index 4eaf9368be..44e6b12703 100644 --- a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md +++ b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md @@ -105,8 +105,8 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_service_created_with_suspicious_service_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -141,7 +141,7 @@ Legitimate applications may install services with uncommon services paths. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md index 95e77dbca5..1c40def6e4 100644 --- a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md +++ b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md @@ -107,8 +107,8 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_service_created_within_public_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -142,7 +142,7 @@ Legitimate applications may install services with uncommon services paths. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md index 099eac2a44..479ec8abb8 100644 --- a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md @@ -143,7 +143,7 @@ Legitimate applications may trigger this behavior, filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md index db4463390b..cc5641f5df 100644 --- a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md @@ -148,7 +148,7 @@ Legitimate applications may trigger this behavior, filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md index bbc252e457..e794dc5af9 100644 --- a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md @@ -149,7 +149,7 @@ Legitimate applications may trigger this behavior, filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md b/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md index d8c3a3325e..c4f1f46cc0 100644 --- a/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md +++ b/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md @@ -150,7 +150,7 @@ Admin or user may choose to use this windows features. Filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md b/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md index 390824b54a..6c2914b698 100644 --- a/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md +++ b/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md @@ -106,8 +106,8 @@ This analytic will detect a suspicious process commandline related to windows de #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_windows_defender_exclusion_commands_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -142,7 +142,7 @@ admin or user may choose to use this windows features. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md b/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md index 0fde2be7d5..e177a9deac 100644 --- a/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md +++ b/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md @@ -148,7 +148,7 @@ admin or user may choose to use this windows features. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md index 404c6dbede..bb1802f83a 100644 --- a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md +++ b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md @@ -142,7 +142,7 @@ False positives should be limited as this is restricted to the Rclone process na > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md index 289446a6ed..7b27f7aed5 100644 --- a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md +++ b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md @@ -178,7 +178,7 @@ Legitimate applications may spawn PowerShell as a child process of the the ident > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md index 88b4085dff..7b680ce19e 100644 --- a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md +++ b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md @@ -145,7 +145,7 @@ Legitimate applications may use random Scheduled Task names. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md index 871bb5653a..8c0118f01d 100644 --- a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md +++ b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md @@ -144,7 +144,7 @@ Legitimate applications may use random Windows Service names. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md index bbfc479e6d..3cf570d475 100644 --- a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md +++ b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md @@ -144,7 +144,7 @@ An single endpoint requesting a large number of computer service tickets is not > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md index 922399b209..f3bc05c48a 100644 --- a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md +++ b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md @@ -144,7 +144,7 @@ An single endpoint authenticating to a large number of hosts is not common behav > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-03-short_lived_scheduled_task.md b/docs/_posts/2021-12-03-short_lived_scheduled_task.md index 718944ddf8..0f5a5570f9 100644 --- a/docs/_posts/2021-12-03-short_lived_scheduled_task.md +++ b/docs/_posts/2021-12-03-short_lived_scheduled_task.md @@ -139,7 +139,7 @@ Although uncommon, legitimate applications may create and delete a Scheduled Tas > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md b/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md index 6bf001f00d..f70a9508fb 100644 --- a/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md +++ b/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md @@ -141,7 +141,7 @@ Unless an administrator is using these commands to troubleshoot or audit a syste > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-07-ms_exchange_mailbox_replication_service_writing_active_server_pages.md b/docs/_posts/2021-12-07-ms_exchange_mailbox_replication_service_writing_active_server_pages.md index cdac3522d6..b239eeaaf8 100644 --- a/docs/_posts/2021-12-07-ms_exchange_mailbox_replication_service_writing_active_server_pages.md +++ b/docs/_posts/2021-12-07-ms_exchange_mailbox_replication_service_writing_active_server_pages.md @@ -158,7 +158,7 @@ The query is structured in a way that `action` (read, create) is not defined. Re > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md b/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md index 8110953841..2ef2e5e6e0 100644 --- a/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md +++ b/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md @@ -143,7 +143,7 @@ False positives should be limited, however filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md index 5c583f189b..d94c2cff62 100644 --- a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md +++ b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md @@ -156,7 +156,7 @@ It is possible some Administrative utilities will load msi.dll outside of normal > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md index afa6e97e98..0c8c4f2440 100644 --- a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md +++ b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md @@ -149,7 +149,7 @@ False positives should be limited, however filtering may be required. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md index 1dd74c2641..3247414e8f 100644 --- a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md +++ b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md @@ -149,7 +149,7 @@ False positives should be limited, however filtering may be required. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md b/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md index 2739356c51..8da17f93fe 100644 --- a/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md +++ b/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md @@ -154,7 +154,7 @@ Unknown at this moment. Outbound LDAP traffic should not be allowed outbound thr > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md b/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md index 40a8b78fce..836cd08fa5 100644 --- a/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md +++ b/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md @@ -142,7 +142,7 @@ Filtering may be required in some instances, filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-13-linux_java_spawning_shell.md b/docs/_posts/2021-12-13-linux_java_spawning_shell.md index 57bea1b9ca..363dd9cec2 100644 --- a/docs/_posts/2021-12-13-linux_java_spawning_shell.md +++ b/docs/_posts/2021-12-13-linux_java_spawning_shell.md @@ -107,9 +107,9 @@ The following analytic identifies the process name of Java, Apache, or Tomcat sp #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [linux_shells](https://github.com/splunk/security_content/blob/develop/macros/linux_shells.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_java_spawning_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -151,7 +151,7 @@ Filtering may be required on internal developer build systems or classify assets > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md index f2b8046c80..e7d29b449b 100644 --- a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md +++ b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md @@ -158,7 +158,7 @@ If there is a vulnerablility scannner looking for log4shells this will trigger, > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md index 2489753379..09319deb53 100644 --- a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md +++ b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md @@ -166,7 +166,7 @@ If there is a vulnerablility scannner looking for log4shells this will trigger, > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md index 90e1ca92fc..83df26299f 100644 --- a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md +++ b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md @@ -150,7 +150,7 @@ Legitimate Java applications may use perform outbound connections to these ports > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-13-windows_java_spawning_shells.md b/docs/_posts/2021-12-13-windows_java_spawning_shells.md index c5f723083c..130435c879 100644 --- a/docs/_posts/2021-12-13-windows_java_spawning_shells.md +++ b/docs/_posts/2021-12-13-windows_java_spawning_shells.md @@ -109,8 +109,8 @@ The following analytic identifies the process name of java.exe and w3wp.exe spaw #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: @@ -151,7 +151,7 @@ Filtering may be required on internal developer build systems or classify assets > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-14-hunting_for_log4shell.md b/docs/_posts/2021-12-14-hunting_for_log4shell.md index 8d27ed5fdf..639560890c 100644 --- a/docs/_posts/2021-12-14-hunting_for_log4shell.md +++ b/docs/_posts/2021-12-14-hunting_for_log4shell.md @@ -265,7 +265,7 @@ It is highly possible you will find false positives, however, the base score is > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md b/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md index 148bbcda60..7a887aa3c0 100644 --- a/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md +++ b/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md @@ -153,7 +153,7 @@ Administrator or network operator can create file in crontab folders for automat > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md b/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md index eb83562a6c..bb6a258cfd 100644 --- a/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md +++ b/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md @@ -153,7 +153,7 @@ Administrator or network operator can create this file for automation purposes. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md b/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md index 2ca39da257..953ced99a4 100644 --- a/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md +++ b/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md @@ -155,7 +155,7 @@ Administrator or network operator can use this application for automation purpos > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md b/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md index 2cf6604f36..03a9fd16f5 100644 --- a/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md +++ b/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md @@ -155,7 +155,7 @@ Administrator or network operator can use this commandline for automation purpos > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md b/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md index 15eaea4b60..ed0ee79276 100644 --- a/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md +++ b/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md @@ -155,7 +155,7 @@ Administrator or network operator can use this commandline for automation purpos > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md b/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md index c23441d92c..6f00971b99 100644 --- a/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md +++ b/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md @@ -151,7 +151,7 @@ Administrator or network operator can create file in this folders for automation > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md b/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md index 041d261d40..2dbf6a99e7 100644 --- a/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md +++ b/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md @@ -151,7 +151,7 @@ Administrator or network operator can create file in profile.d folders for autom > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md b/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md index 3b3d0cf203..a9fdbc8fcb 100644 --- a/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md +++ b/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md @@ -153,7 +153,7 @@ Administrator or network operator can use this commandline for automation purpos > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md b/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md index 7ca13ac890..987f16168d 100644 --- a/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md +++ b/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md @@ -153,7 +153,7 @@ Administrator or network operator can create file in systemd folders for automat > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-20-linux_service_restarted.md b/docs/_posts/2021-12-20-linux_service_restarted.md index 175cd02418..f35765c93a 100644 --- a/docs/_posts/2021-12-20-linux_service_restarted.md +++ b/docs/_posts/2021-12-20-linux_service_restarted.md @@ -155,7 +155,7 @@ Administrator or network operator can use this commandline for automation purpos > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-20-linux_service_started_or_enabled.md b/docs/_posts/2021-12-20-linux_service_started_or_enabled.md index 5c174d8f57..eec3c468b0 100644 --- a/docs/_posts/2021-12-20-linux_service_started_or_enabled.md +++ b/docs/_posts/2021-12-20-linux_service_started_or_enabled.md @@ -155,7 +155,7 @@ Administrator or network operator can use this commandline for automation purpos > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md b/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md index ad1384e32f..d59ae2807a 100644 --- a/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md +++ b/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md @@ -151,7 +151,7 @@ Renaming a computer account name to a name that not end with '$' is highly unsua > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md b/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md index ff008f918e..042d4f87c1 100644 --- a/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md +++ b/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md @@ -154,7 +154,7 @@ We have tested this detection logic with ~2 million 4769 events and did not iden > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-21-linux_add_user_account.md b/docs/_posts/2021-12-21-linux_add_user_account.md index 2d49daf112..9584b01ede 100644 --- a/docs/_posts/2021-12-21-linux_add_user_account.md +++ b/docs/_posts/2021-12-21-linux_add_user_account.md @@ -151,7 +151,7 @@ Administrator or network operator can execute this command. Please update the fi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md b/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md index dee99ea4db..35bdfcb666 100644 --- a/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md +++ b/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md @@ -151,7 +151,7 @@ Administrator or network operator can execute this command. Please update the fi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md b/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md index bea14acb38..31ddc7dcaa 100644 --- a/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md +++ b/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md @@ -153,7 +153,7 @@ Administrator or network operator can execute this command. Please update the fi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md index 49f2f21f83..a5ce53de0b 100644 --- a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md +++ b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md @@ -153,7 +153,7 @@ Administrator or network operator can execute this command. Please update the fi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md index efbdb8126c..3f84cbaeda 100644 --- a/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md +++ b/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md @@ -153,7 +153,7 @@ Administrator or network operator can execute this command. Please update the fi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-21-linux_visudo_utility_execution.md b/docs/_posts/2021-12-21-linux_visudo_utility_execution.md index 65714b0501..3116da0cc8 100644 --- a/docs/_posts/2021-12-21-linux_visudo_utility_execution.md +++ b/docs/_posts/2021-12-21-linux_visudo_utility_execution.md @@ -153,7 +153,7 @@ Administrator or network operator can execute this command. Please update the fi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md b/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md index 7bb042e971..7eda0ed77a 100644 --- a/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md +++ b/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md @@ -149,7 +149,7 @@ A computer account name change event inmediately followed by a kerberos TGT requ > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md b/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md index cc14c79135..e756d513a2 100644 --- a/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md +++ b/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md @@ -151,7 +151,7 @@ Administrator or network operator can create file in this folders for automation > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md b/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md index e174e88705..b2488c3634 100644 --- a/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md +++ b/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md @@ -153,7 +153,7 @@ Administrator or network operator can execute this command. Please update the fi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md b/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md index 42f442785c..7f68a84eeb 100644 --- a/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md +++ b/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md @@ -153,7 +153,7 @@ Administrator or network operator can execute this command. Please update the fi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md b/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md index f338bfbad4..ecf91245bd 100644 --- a/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md +++ b/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md @@ -155,7 +155,7 @@ Administrator or network operator can execute this command. Please update the fi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md b/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md index 58e79c9c2a..c58ac363d4 100644 --- a/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md +++ b/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md @@ -153,7 +153,7 @@ Administrator or network operator can execute this command. Please update the fi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md b/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md index 30db9c35f1..0087e4ed82 100644 --- a/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md +++ b/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md @@ -151,7 +151,7 @@ administrator or network operator can execute this command. Please update the fi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md b/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md index 1d490859e9..339e2ffa54 100644 --- a/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md +++ b/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md @@ -153,7 +153,7 @@ Administrator or network operator can execute this command. Please update the fi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md b/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md index 8935470913..9eb88bf61d 100644 --- a/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md +++ b/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md @@ -151,7 +151,7 @@ Administrator or network operator can execute this command. Please update the fi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-05-linux_doas_tool_execution.md b/docs/_posts/2022-01-05-linux_doas_tool_execution.md index 421bcf2b78..a322917bc6 100644 --- a/docs/_posts/2022-01-05-linux_doas_tool_execution.md +++ b/docs/_posts/2022-01-05-linux_doas_tool_execution.md @@ -153,7 +153,7 @@ Administrator or network operator can execute this command. Please update the fi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md b/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md index e2a7710804..9050778c1c 100644 --- a/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md +++ b/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md @@ -151,7 +151,7 @@ Administrator or network operator can execute this command. Please update the fi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md b/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md index 92418065c4..7a328f51ca 100644 --- a/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md +++ b/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md @@ -153,7 +153,7 @@ administrator or network operator can execute this command. Please update the fi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md b/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md index ffb1e0fbe4..3116f02ed4 100644 --- a/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md +++ b/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md @@ -151,7 +151,7 @@ Administrator or network operator can use this commandline for automation purpos > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md b/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md index f6b1140b8a..ee96e8edd4 100644 --- a/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md +++ b/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md @@ -149,7 +149,7 @@ Administrator or network operator can create file in ~/.ssh folders for automati > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md index be29f9c83d..a7e3a6be4d 100644 --- a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md +++ b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md @@ -166,7 +166,7 @@ Legitimate process can have this combination of command-line options, but it's n > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md index 9839b5f4b0..58ff38a98a 100644 --- a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md +++ b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md @@ -146,7 +146,7 @@ False positives will occur based on GrantedAccess and SourceUser, filter based o > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md index 0e7bec302f..c48ad067c4 100644 --- a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md +++ b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md @@ -146,7 +146,7 @@ False positives will occur based on legitimate application requests, filter base > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md index 500a68f3d6..1b41db59c0 100644 --- a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md +++ b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md @@ -145,7 +145,7 @@ This model is an anomaly detector that identifies usage of APIs and scripting co > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md index ee82f4dd90..65de741ab3 100644 --- a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md +++ b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md @@ -112,9 +112,9 @@ The following analytic identifies command-line arguments where `cmd.exe /c` is u #### Macros The SPL above uses the following Macros: +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **cmd_carry_out_string_command_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -157,7 +157,7 @@ False positives may be high based on legitimate scripted code in any environment > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md b/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md index a3e2fd6605..202b1b4442 100644 --- a/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md +++ b/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md @@ -166,7 +166,7 @@ Although uncommon, Administrators may leverage Impackets tools to start a proces > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md index c20ab4e6f5..f58ff3f639 100644 --- a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md +++ b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md @@ -159,7 +159,7 @@ System administrators may use this option, but it's not common. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md b/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md index 12873a5171..79d72396a3 100644 --- a/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md +++ b/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md @@ -112,8 +112,8 @@ This analytic will identify a suspicious PowerShell command used to delete the W #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_remove_windows_defender_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -146,7 +146,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md index 7e351060dc..b4a40a14d5 100644 --- a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md +++ b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md @@ -143,7 +143,7 @@ Noise and false positive can be seen if the following instant messaging is allow > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md b/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md index 31abbed1eb..168f96010b 100644 --- a/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md +++ b/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md @@ -149,7 +149,7 @@ Noise and false positive can be seen if the following instant messaging is allow > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md index b3ad1dae14..12c713a123 100644 --- a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md +++ b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md @@ -164,7 +164,7 @@ False positives may be present and filtering may be required. Certain utilities > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md index c9146ffb25..14da8b3f81 100644 --- a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md +++ b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md @@ -117,9 +117,9 @@ The following analytic identifies the Windows binary InstallUtil.exe running fro #### Macros The SPL above uses the following Macros: +* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) > :information_source: > **windows_installutil_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -164,7 +164,7 @@ False positives may be present and filtering may be required. Certain utilities > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md index 954e5ee56b..f0282edf5f 100644 --- a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md +++ b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md @@ -144,7 +144,7 @@ Windows Defender AV updates may cause this alert. Please update the filter macro > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-20-ping_sleep_batch_command.md b/docs/_posts/2022-01-20-ping_sleep_batch_command.md index a139f4e8c3..548baa0f37 100644 --- a/docs/_posts/2022-01-20-ping_sleep_batch_command.md +++ b/docs/_posts/2022-01-20-ping_sleep_batch_command.md @@ -157,7 +157,7 @@ Administrator or network operator may execute this command. Please update the fi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md b/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md index b4b4ea67b5..63f965312e 100644 --- a/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md +++ b/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md @@ -145,7 +145,7 @@ False positives should be limited as it is specific to AdvancedRun. Filter as ne > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md index f75eec4c30..58eb298f76 100644 --- a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md +++ b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md @@ -103,9 +103,9 @@ The following hunting analytic assists with identifying the proces execution of #### Macros The SPL above uses the following Macros: -* [is_nirsoft_software](https://github.com/splunk/security_content/blob/develop/macros/is_nirsoft_software.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [is_nirsoft_software](https://github.com/splunk/security_content/blob/develop/macros/is_nirsoft_software.yml) > :information_source: > **windows_nirsoft_utilities_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -145,7 +145,7 @@ False positives may be present. Filtering may be required before setting to aler > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-26-active_setup_registry_autostart.md b/docs/_posts/2022-01-26-active_setup_registry_autostart.md index e78367bbfe..c5d5125d42 100644 --- a/docs/_posts/2022-01-26-active_setup_registry_autostart.md +++ b/docs/_posts/2022-01-26-active_setup_registry_autostart.md @@ -150,7 +150,7 @@ Active setup installer may add or modify this registry. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md b/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md index d95d5994ed..be541bc837 100644 --- a/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md +++ b/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md @@ -145,7 +145,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md b/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md index d6290c8142..0228edccd1 100644 --- a/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md +++ b/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md @@ -154,7 +154,7 @@ network admin may add/remove/modify public inbound firewall rule that may cause > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md b/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md index 3e3d8e950b..03327806bb 100644 --- a/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md +++ b/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md @@ -142,7 +142,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-26-disable_amsi_through_registry.md b/docs/_posts/2022-01-26-disable_amsi_through_registry.md index 7d321ec83c..ff0458821c 100644 --- a/docs/_posts/2022-01-26-disable_amsi_through_registry.md +++ b/docs/_posts/2022-01-26-disable_amsi_through_registry.md @@ -147,7 +147,7 @@ network operator may disable this feature of windows but not so common. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md b/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md index 86bd7cffc0..9c79d1047d 100644 --- a/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md +++ b/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md @@ -148,7 +148,7 @@ admin or user may choose to disable windows defender product > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md b/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md index 80f501ec51..e8ecd64163 100644 --- a/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md +++ b/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md @@ -148,7 +148,7 @@ admin or user may choose to disable windows defender product > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md b/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md index c5b2b218ef..613b45ea6c 100644 --- a/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md +++ b/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md @@ -148,7 +148,7 @@ user may choose to disable windows defender AV > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md b/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md index d41b3e0179..b660e79003 100644 --- a/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md +++ b/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md @@ -148,7 +148,7 @@ admin or user may choose to disable windows defender product > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md b/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md index c82531b9d7..071f89f0f7 100644 --- a/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md +++ b/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md @@ -148,7 +148,7 @@ admin or user may choose to disable windows defender product > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md b/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md index 5cd596c82c..153296ecd2 100644 --- a/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md +++ b/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md @@ -148,7 +148,7 @@ admin or user may choose to disable windows defender product > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md b/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md index c9bdd0e747..26e45f6eac 100644 --- a/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md +++ b/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md @@ -156,7 +156,7 @@ There are no known false positive for this search, but it could contain false po > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md b/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md index 4342c653dc..cd12971e34 100644 --- a/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md +++ b/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md @@ -162,7 +162,7 @@ There are many legitimate applications that must execute on system startup and w > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md b/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md index 25f3c092e4..8767517fe9 100644 --- a/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md +++ b/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md @@ -155,7 +155,7 @@ There are many legitimate applications that must execute upon system startup and > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md b/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md index 7d2703535d..30c9c11ef0 100644 --- a/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md +++ b/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md @@ -142,7 +142,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-26-time_provider_persistence_registry.md b/docs/_posts/2022-01-26-time_provider_persistence_registry.md index b83a0c9bd9..0fc3d43f90 100644 --- a/docs/_posts/2022-01-26-time_provider_persistence_registry.md +++ b/docs/_posts/2022-01-26-time_provider_persistence_registry.md @@ -151,7 +151,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-27-disable_etw_through_registry.md b/docs/_posts/2022-01-27-disable_etw_through_registry.md index b5105e8257..33ea75c57f 100644 --- a/docs/_posts/2022-01-27-disable_etw_through_registry.md +++ b/docs/_posts/2022-01-27-disable_etw_through_registry.md @@ -147,7 +147,7 @@ network operator may disable this feature of windows but not so common. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-27-disable_registry_tool.md b/docs/_posts/2022-01-27-disable_registry_tool.md index 844a0b79d8..10fdb2c92c 100644 --- a/docs/_posts/2022-01-27-disable_registry_tool.md +++ b/docs/_posts/2022-01-27-disable_registry_tool.md @@ -147,7 +147,7 @@ admin may disable this application for non technical user. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md b/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md index fbdb9cf5df..df5824fc68 100644 --- a/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md +++ b/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md @@ -143,7 +143,7 @@ Unknown. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-27-disable_show_hidden_files.md b/docs/_posts/2022-01-27-disable_show_hidden_files.md index 2c45f86d07..3236fba6b5 100644 --- a/docs/_posts/2022-01-27-disable_show_hidden_files.md +++ b/docs/_posts/2022-01-27-disable_show_hidden_files.md @@ -157,7 +157,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-27-disable_uac_remote_restriction.md b/docs/_posts/2022-01-27-disable_uac_remote_restriction.md index 52dfda2ad1..c6860f04ad 100644 --- a/docs/_posts/2022-01-27-disable_uac_remote_restriction.md +++ b/docs/_posts/2022-01-27-disable_uac_remote_restriction.md @@ -151,7 +151,7 @@ admin may set this policy for non-critical machine. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md b/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md index 5cce0988ec..765d1665a4 100644 --- a/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md +++ b/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md @@ -146,7 +146,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md b/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md index db3f62dedc..97b4f403b9 100644 --- a/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md +++ b/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md @@ -149,7 +149,7 @@ admin or user may choose to disable this windows features. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md b/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md index 365fe9129e..89b192342e 100644 --- a/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md +++ b/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md @@ -147,7 +147,7 @@ admin or user may choose to disable this windows features. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-27-disabling_cmd_application.md b/docs/_posts/2022-01-27-disabling_cmd_application.md index 1b0d437892..0b91cd2c7f 100644 --- a/docs/_posts/2022-01-27-disabling_cmd_application.md +++ b/docs/_posts/2022-01-27-disabling_cmd_application.md @@ -147,7 +147,7 @@ admin may disable this application for non technical user. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-27-disabling_controlpanel.md b/docs/_posts/2022-01-27-disabling_controlpanel.md index 2f55f1fdc6..b22b05aff6 100644 --- a/docs/_posts/2022-01-27-disabling_controlpanel.md +++ b/docs/_posts/2022-01-27-disabling_controlpanel.md @@ -147,7 +147,7 @@ admin may disable this application for non technical user. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md index 5be08885fe..e89c702ca3 100644 --- a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md +++ b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md @@ -152,7 +152,7 @@ False positives will occur based on GrantedAccess 0x1010 and 0x1400, filter base > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-28-disabling_defender_services.md b/docs/_posts/2022-01-28-disabling_defender_services.md index b6cec46011..34d3839dcb 100644 --- a/docs/_posts/2022-01-28-disabling_defender_services.md +++ b/docs/_posts/2022-01-28-disabling_defender_services.md @@ -148,7 +148,7 @@ admin or user may choose to disable windows defender product > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md b/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md index 14a0581efd..a251d8ef82 100644 --- a/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md +++ b/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md @@ -147,7 +147,7 @@ admin may disable this application for non technical user. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-28-disabling_norun_windows_app.md b/docs/_posts/2022-01-28-disabling_norun_windows_app.md index a1910fef76..cdeac497d7 100644 --- a/docs/_posts/2022-01-28-disabling_norun_windows_app.md +++ b/docs/_posts/2022-01-28-disabling_norun_windows_app.md @@ -147,7 +147,7 @@ admin may disable this application for non technical user. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md b/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md index 6da7aead2c..b3678b70de 100644 --- a/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md +++ b/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md @@ -142,7 +142,7 @@ in some cases admin can disable systemrestore on a machine. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-28-disabling_task_manager.md b/docs/_posts/2022-01-28-disabling_task_manager.md index d1fd5180f0..00d2da2921 100644 --- a/docs/_posts/2022-01-28-disabling_task_manager.md +++ b/docs/_posts/2022-01-28-disabling_task_manager.md @@ -147,7 +147,7 @@ admin may disable this application for non technical user. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md b/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md index 82d1a16e3b..40eda14163 100644 --- a/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md +++ b/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md @@ -141,7 +141,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md b/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md index e6973f2cb6..9b3469b0a9 100644 --- a/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md +++ b/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md @@ -148,7 +148,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-28-etw_registry_disabled.md b/docs/_posts/2022-01-28-etw_registry_disabled.md index b980e4c789..c79587eef9 100644 --- a/docs/_posts/2022-01-28-etw_registry_disabled.md +++ b/docs/_posts/2022-01-28-etw_registry_disabled.md @@ -155,7 +155,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-28-eventvwr_uac_bypass.md b/docs/_posts/2022-01-28-eventvwr_uac_bypass.md index e0c4d58d79..f5818add05 100644 --- a/docs/_posts/2022-01-28-eventvwr_uac_bypass.md +++ b/docs/_posts/2022-01-28-eventvwr_uac_bypass.md @@ -151,7 +151,7 @@ Some false positives may be present and will need to be filtered. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md b/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md index 9308b22159..afa35b8952 100644 --- a/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md +++ b/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md @@ -146,7 +146,7 @@ Unknown. Filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md b/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md index 3c82a3c3bd..b4d42dcb83 100644 --- a/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md +++ b/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md @@ -149,7 +149,7 @@ False positives may be present, filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md b/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md index 6cb0dda1e0..ea2831e11f 100644 --- a/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md +++ b/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md @@ -147,7 +147,7 @@ Although highly unlikely, legitimate applications may use the same command line > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-01-rubeus_command_line_parameters.md b/docs/_posts/2022-02-01-rubeus_command_line_parameters.md index 5ca8afecc3..1569f59492 100644 --- a/docs/_posts/2022-02-01-rubeus_command_line_parameters.md +++ b/docs/_posts/2022-02-01-rubeus_command_line_parameters.md @@ -162,7 +162,7 @@ Although unlikely, legitimate applications may use the same command line paramet > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md index d124e85f2e..b0dc4c81af 100644 --- a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md +++ b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md @@ -102,9 +102,9 @@ Certutil.exe may download a file from a remote destination using `-urlcache`. Th #### Macros The SPL above uses the following Macros: -* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) > :information_source: > **certutil_download_with_urlcache_and_split_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -146,7 +146,7 @@ Limited false positives in most environments, however tune as needed based on pa > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md index 30f4cba28a..9d1509047e 100644 --- a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md +++ b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md @@ -102,9 +102,9 @@ Certutil.exe may download a file from a remote destination using `-VerifyCtl`. T #### Macros The SPL above uses the following Macros: -* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) > :information_source: > **certutil_download_with_verifyctl_and_split_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -146,7 +146,7 @@ Limited false positives in most environments, however tune as needed based on pa > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-03-o365_added_service_principal.md b/docs/_posts/2022-02-03-o365_added_service_principal.md index 23f868393b..675f3abf1c 100644 --- a/docs/_posts/2022-02-03-o365_added_service_principal.md +++ b/docs/_posts/2022-02-03-o365_added_service_principal.md @@ -105,8 +105,8 @@ This search detects the creation of a new Federation setting by alerting about a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **o365_added_service_principal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -143,7 +143,7 @@ The creation of a new Federation is not necessarily malicious, however these eve > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md b/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md index 4c9c1ff46b..861cd2db17 100644 --- a/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md +++ b/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md @@ -110,8 +110,8 @@ This search detects newly added IP addresses/CIDR blocks to the list of MFA Trus #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **o365_bypass_mfa_via_trusted_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -149,7 +149,7 @@ Unless it is a special case, it is uncommon to continually update Trusted IPs to > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-03-o365_disable_mfa.md b/docs/_posts/2022-02-03-o365_disable_mfa.md index 35f00e5896..c8571f10e9 100644 --- a/docs/_posts/2022-02-03-o365_disable_mfa.md +++ b/docs/_posts/2022-02-03-o365_disable_mfa.md @@ -102,8 +102,8 @@ This search detects when multi factor authentication has been disabled, what ent #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **o365_disable_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -139,7 +139,7 @@ Unless it is a special case, it is uncommon to disable MFA or Strong Authenticat > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md index 7dcf9c4e13..df18dc6ceb 100644 --- a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md +++ b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md @@ -145,7 +145,7 @@ Legitimate applications may obtain a handle for winlogon.exe. Filter as needed > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md index 3baffe3234..250e164d6a 100644 --- a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md +++ b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md @@ -103,8 +103,8 @@ The following analytic identifies the use of Microsoft Remote Assistance, msra.e #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: @@ -145,7 +145,7 @@ False positives should be limited, filter as needed. Add additional shells as ne > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md index 5275ef3d5e..16d1ce75e5 100644 --- a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md +++ b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md @@ -153,7 +153,7 @@ False positives will be limited to legitimate applications creating a task to ru > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md index c524fdfaa7..7722a45d94 100644 --- a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md +++ b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md @@ -157,7 +157,7 @@ False positives are possible with native utilities and third party applications. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-08-unusual_number_of_kerberos_service_tickets_requested.md b/docs/_posts/2022-02-08-unusual_number_of_kerberos_service_tickets_requested.md index fe702e079b..aad5633fbd 100644 --- a/docs/_posts/2022-02-08-unusual_number_of_kerberos_service_tickets_requested.md +++ b/docs/_posts/2022-02-08-unusual_number_of_kerberos_service_tickets_requested.md @@ -145,7 +145,7 @@ An single endpoint requesting a large number of kerberos service tickets is not > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md b/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md index c471caa50d..8ebe56389a 100644 --- a/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md +++ b/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md @@ -148,7 +148,7 @@ Older systems that support kerberos RC4 by default like NetApp may generate fals > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-11-linux_system_network_discovery.md b/docs/_posts/2022-02-11-linux_system_network_discovery.md index 7f2eb1eb93..89119be3a4 100644 --- a/docs/_posts/2022-02-11-linux_system_network_discovery.md +++ b/docs/_posts/2022-02-11-linux_system_network_discovery.md @@ -144,7 +144,7 @@ Administrator or network operator can execute this command. Please update the fi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-14-linux_dd_file_overwrite.md b/docs/_posts/2022-02-14-linux_dd_file_overwrite.md index 7c59659997..0cfb7e786f 100644 --- a/docs/_posts/2022-02-14-linux_dd_file_overwrite.md +++ b/docs/_posts/2022-02-14-linux_dd_file_overwrite.md @@ -146,7 +146,7 @@ Administrator or network operator can execute this command. Please update the fi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-15-detection_of_dns_tunnels.md b/docs/_posts/2022-02-15-detection_of_dns_tunnels.md index 0a56acc766..234ca13d04 100644 --- a/docs/_posts/2022-02-15-detection_of_dns_tunnels.md +++ b/docs/_posts/2022-02-15-detection_of_dns_tunnels.md @@ -151,7 +151,7 @@ It's possible that normal DNS traffic will exhibit this behavior. If an alert is > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md index 9f58e0cbc6..ff5d46003c 100644 --- a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md +++ b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md @@ -106,9 +106,9 @@ DiskShadow.exe is a Microsoft Signed binary present on Windows Server. It has a #### Macros The SPL above uses the following Macros: -* [process_diskshadow](https://github.com/splunk/security_content/blob/develop/macros/process_diskshadow.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_diskshadow](https://github.com/splunk/security_content/blob/develop/macros/process_diskshadow.yml) > :information_source: > **windows_diskshadow_proxy_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -145,7 +145,7 @@ Administrators using the DiskShadow tool in their infrastructure as a main backu > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md b/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md index 651f22d93b..bba5c4564b 100644 --- a/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md +++ b/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md @@ -155,7 +155,7 @@ False positives will be limited to applications that require Rasautou.exe to loa > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-17-windows_disable_notification_center.md b/docs/_posts/2022-02-17-windows_disable_notification_center.md index 19ec2e9dd0..5566bb8bc7 100644 --- a/docs/_posts/2022-02-17-windows_disable_notification_center.md +++ b/docs/_posts/2022-02-17-windows_disable_notification_center.md @@ -147,7 +147,7 @@ admin or user may choose to disable this windows features. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md index e694e72012..39f2b80d72 100644 --- a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md +++ b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md @@ -152,7 +152,7 @@ This event is really notable but we found minimal number of normal application f > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md index 853c26e96f..51d1e73d56 100644 --- a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md +++ b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md @@ -150,7 +150,7 @@ Although unlikely, limited instances of regasm.exe with a network connection may > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md index 8fa658fda9..663285a202 100644 --- a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md +++ b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md @@ -149,7 +149,7 @@ Although unlikely, limited instances of regsvcs.exe may cause a false positive. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md b/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md index 4e25e1d358..3c247d1e0f 100644 --- a/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md +++ b/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **disabled_kerberos_pre-authentication_discovery_with_powerview_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -138,7 +138,7 @@ Administrators or power users may use PowerView for troubleshooting > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-18-net_profiler_uac_bypass.md b/docs/_posts/2022-02-18-net_profiler_uac_bypass.md index de1ef87e61..1cf612c716 100644 --- a/docs/_posts/2022-02-18-net_profiler_uac_bypass.md +++ b/docs/_posts/2022-02-18-net_profiler_uac_bypass.md @@ -143,7 +143,7 @@ limited false positive. It may trigger by some windows update that will modify t > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md b/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md index cd2798fb45..9552bd6766 100644 --- a/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md +++ b/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md @@ -101,8 +101,8 @@ This search detects when an excessive number of authentication failures occur th #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **o365_excessive_authentication_failures_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -137,7 +137,7 @@ The threshold for alert is above 10 attempts and this should reduce the number o > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md index 31ad7496fe..fe11db54f8 100644 --- a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md +++ b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md @@ -144,7 +144,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-18-rundll32_dnsquery.md b/docs/_posts/2022-02-18-rundll32_dnsquery.md index eabf4664b9..75b9319c65 100644 --- a/docs/_posts/2022-02-18-rundll32_dnsquery.md +++ b/docs/_posts/2022-02-18-rundll32_dnsquery.md @@ -142,7 +142,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md b/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md index 6300fa79d4..13c28723df 100644 --- a/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md +++ b/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md @@ -150,7 +150,7 @@ Administrators may attempt to change the default execution policy on a system fo > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md b/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md index dd7d59e564..2b99704f67 100644 --- a/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md +++ b/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **disabled_kerberos_pre-authentication_discovery_with_get-aduser_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -138,7 +138,7 @@ Administrators or power users may use search for accounts with Kerberos Pre Auth > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-22-kerberos_pre-authentication_flag_disabled_in_useraccountcontrol.md b/docs/_posts/2022-02-22-kerberos_pre-authentication_flag_disabled_in_useraccountcontrol.md index 49f1dac279..e3b8c287a9 100644 --- a/docs/_posts/2022-02-22-kerberos_pre-authentication_flag_disabled_in_useraccountcontrol.md +++ b/docs/_posts/2022-02-22-kerberos_pre-authentication_flag_disabled_in_useraccountcontrol.md @@ -136,7 +136,7 @@ Unknown. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md b/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md index 80c79551e7..8c5011facc 100644 --- a/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md +++ b/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md @@ -154,7 +154,7 @@ It is possible scripts or administrators may trigger this analytic. Filter as ne > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md index b4091d27d8..354377901f 100644 --- a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md +++ b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md @@ -108,9 +108,9 @@ This analytic is to look for wmi commandlines to execute or create process. This #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) > :information_source: > **windows_wmi_process_call_create_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -151,7 +151,7 @@ Administrators may execute this command for testing or auditing. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md b/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md index bfcbee171d..0fa7e197b5 100644 --- a/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md +++ b/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md @@ -113,8 +113,8 @@ This analytic will identify suspicious excessive number of system events of serv #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_excessive_disabled_services_event_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -148,7 +148,7 @@ Unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md b/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md index 5cf7fc9718..e336a11827 100644 --- a/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md +++ b/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md @@ -151,7 +151,7 @@ Normal browser application may use this technique. Please update the filter macr > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-23-windows_service_creation_using_registry_entry.md b/docs/_posts/2022-02-23-windows_service_creation_using_registry_entry.md index 63a2b37849..cf4168b5d4 100644 --- a/docs/_posts/2022-02-23-windows_service_creation_using_registry_entry.md +++ b/docs/_posts/2022-02-23-windows_service_creation_using_registry_entry.md @@ -159,7 +159,7 @@ Third party tools may used this technique to create services but not so common. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-24-aws_lambda_updatefunctioncode.md b/docs/_posts/2022-02-24-aws_lambda_updatefunctioncode.md index e37d1c02d1..3c4596dedd 100644 --- a/docs/_posts/2022-02-24-aws_lambda_updatefunctioncode.md +++ b/docs/_posts/2022-02-24-aws_lambda_updatefunctioncode.md @@ -136,7 +136,7 @@ While this search has no known false positives, it is possible that an AWS admin > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-25-windows_disable_memory_crash_dump.md b/docs/_posts/2022-02-25-windows_disable_memory_crash_dump.md index 07182f3322..4b67cb97fb 100644 --- a/docs/_posts/2022-02-25-windows_disable_memory_crash_dump.md +++ b/docs/_posts/2022-02-25-windows_disable_memory_crash_dump.md @@ -156,7 +156,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md b/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md index b4d0bec646..7c5c0a2b02 100644 --- a/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md +++ b/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md @@ -155,7 +155,7 @@ Unknown at this point > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md index e6bcb8620f..8585a4f9e0 100644 --- a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md +++ b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md @@ -151,7 +151,7 @@ This event is really notable but we found minimal number of normal application f > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md b/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md index 2270a4b424..74b80bc8eb 100644 --- a/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md +++ b/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md @@ -136,7 +136,7 @@ Many benign applications will create processes from executables in Windows\Temp, > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-02-windows_modify_show_compress_color_and_info_tip_registry.md b/docs/_posts/2022-03-02-windows_modify_show_compress_color_and_info_tip_registry.md index 37bf50e905..27358ce3c5 100644 --- a/docs/_posts/2022-03-02-windows_modify_show_compress_color_and_info_tip_registry.md +++ b/docs/_posts/2022-03-02-windows_modify_show_compress_color_and_info_tip_registry.md @@ -149,7 +149,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-03-aws_createaccesskey.md b/docs/_posts/2022-03-03-aws_createaccesskey.md index ce59a7c112..fba90e0cfb 100644 --- a/docs/_posts/2022-03-03-aws_createaccesskey.md +++ b/docs/_posts/2022-03-03-aws_createaccesskey.md @@ -113,8 +113,8 @@ This search looks for AWS CloudTrail events where a user A who has already permi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **aws_createaccesskey_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -147,7 +147,7 @@ While this search has no known false positives, it is possible that an AWS admin > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-03-aws_updateloginprofile.md b/docs/_posts/2022-03-03-aws_updateloginprofile.md index e6b11cc76d..d293eae63f 100644 --- a/docs/_posts/2022-03-03-aws_updateloginprofile.md +++ b/docs/_posts/2022-03-03-aws_updateloginprofile.md @@ -113,8 +113,8 @@ This search looks for AWS CloudTrail events where a user A who has already permi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **aws_updateloginprofile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -147,7 +147,7 @@ While this search has no known false positives, it is possible that an AWS admin > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-04-kerberos_tgt_request_using_rc4_encryption.md b/docs/_posts/2022-03-04-kerberos_tgt_request_using_rc4_encryption.md index a2b65f52dc..24db4f18a4 100644 --- a/docs/_posts/2022-03-04-kerberos_tgt_request_using_rc4_encryption.md +++ b/docs/_posts/2022-03-04-kerberos_tgt_request_using_rc4_encryption.md @@ -131,7 +131,7 @@ Based on Microsoft documentation, legacy systems or applications will use RC4-HM > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-04-macos_lolbin.md b/docs/_posts/2022-03-04-macos_lolbin.md index 586e56f0e1..94c82a2200 100644 --- a/docs/_posts/2022-03-04-macos_lolbin.md +++ b/docs/_posts/2022-03-04-macos_lolbin.md @@ -152,7 +152,7 @@ None identified. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-08-suspicious_msbuild_path.md b/docs/_posts/2022-03-08-suspicious_msbuild_path.md index 80f56f383a..ea72828393 100644 --- a/docs/_posts/2022-03-08-suspicious_msbuild_path.md +++ b/docs/_posts/2022-03-08-suspicious_msbuild_path.md @@ -167,7 +167,7 @@ Some legitimate applications may use a moved copy of msbuild.exe, triggering a f > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-08-windows_disable_change_password_through_registry.md b/docs/_posts/2022-03-08-windows_disable_change_password_through_registry.md index 80d88f0f64..4a7e68182c 100644 --- a/docs/_posts/2022-03-08-windows_disable_change_password_through_registry.md +++ b/docs/_posts/2022-03-08-windows_disable_change_password_through_registry.md @@ -155,7 +155,7 @@ This windows feature may implemented by administrator to prevent normal user to > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-08-windows_disable_lock_workstation_feature_through_registry.md b/docs/_posts/2022-03-08-windows_disable_lock_workstation_feature_through_registry.md index b1c026cbbe..a2dd71f025 100644 --- a/docs/_posts/2022-03-08-windows_disable_lock_workstation_feature_through_registry.md +++ b/docs/_posts/2022-03-08-windows_disable_lock_workstation_feature_through_registry.md @@ -155,7 +155,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-08-windows_disable_logoff_button_through_registry.md b/docs/_posts/2022-03-08-windows_disable_logoff_button_through_registry.md index 80ea1ac202..278fceffc5 100644 --- a/docs/_posts/2022-03-08-windows_disable_logoff_button_through_registry.md +++ b/docs/_posts/2022-03-08-windows_disable_logoff_button_through_registry.md @@ -154,7 +154,7 @@ This windows feature may implement by administrator in some server where shutdow > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-08-windows_disable_shutdown_button_through_registry.md b/docs/_posts/2022-03-08-windows_disable_shutdown_button_through_registry.md index 2f1640abeb..f51b36c60c 100644 --- a/docs/_posts/2022-03-08-windows_disable_shutdown_button_through_registry.md +++ b/docs/_posts/2022-03-08-windows_disable_shutdown_button_through_registry.md @@ -154,7 +154,7 @@ This windows feature may implement by administrator in some server where shutdow > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-08-windows_disable_windows_group_policy_features_through_registry.md b/docs/_posts/2022-03-08-windows_disable_windows_group_policy_features_through_registry.md index 12084806eb..3678464dc9 100644 --- a/docs/_posts/2022-03-08-windows_disable_windows_group_policy_features_through_registry.md +++ b/docs/_posts/2022-03-08-windows_disable_windows_group_policy_features_through_registry.md @@ -155,7 +155,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-08-windows_hide_notification_features_through_registry.md b/docs/_posts/2022-03-08-windows_hide_notification_features_through_registry.md index fa6668e9a6..c81bf1648e 100644 --- a/docs/_posts/2022-03-08-windows_hide_notification_features_through_registry.md +++ b/docs/_posts/2022-03-08-windows_hide_notification_features_through_registry.md @@ -155,7 +155,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md b/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md index 492eb43d40..ccc0b8dbdc 100644 --- a/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md +++ b/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md @@ -147,7 +147,7 @@ Custom applications may leverage the Kerberos protocol. Filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-10-kerberos_user_enumeration.md b/docs/_posts/2022-03-10-kerberos_user_enumeration.md index ca11e5348e..cc05e9c673 100644 --- a/docs/_posts/2022-03-10-kerberos_user_enumeration.md +++ b/docs/_posts/2022-03-10-kerberos_user_enumeration.md @@ -141,7 +141,7 @@ Possible false positive scenarios include but are not limited to vulnerability s > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md index 4a51b57c19..b442efd626 100644 --- a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md @@ -156,7 +156,7 @@ Although unlikely, limited instances of regasm.exe or may cause a false positive > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md index 5068280f51..2a33a397b7 100644 --- a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md @@ -113,9 +113,9 @@ The following analytic identifies regsvcs.exe with no command line arguments. Th #### Macros The SPL above uses the following Macros: +* [process_regsvcs](https://github.com/splunk/security_content/blob/develop/macros/process_regsvcs.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_regsvcs](https://github.com/splunk/security_content/blob/develop/macros/process_regsvcs.yml) > :information_source: > **detect_regsvcs_with_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -156,7 +156,7 @@ Although unlikely, limited instances of regsvcs.exe may cause a false positive. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md index c897bca0d1..ffbc1a4619 100644 --- a/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md +++ b/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md @@ -145,7 +145,7 @@ Although unlikely, some legitimate third party applications may use a moved copy > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md index 8b995c0cd9..fbbfcbeb5a 100644 --- a/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md +++ b/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md @@ -145,7 +145,7 @@ Limited false positives may be present in small environments. Tuning may be requ > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md b/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md index 22617d5dad..2b4295dc4f 100644 --- a/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md +++ b/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md @@ -141,7 +141,7 @@ Based on Microsoft documentation, legacy systems or applications will use RC4-HM > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md index aeeb2a5286..d59dbdf38a 100644 --- a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md +++ b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md @@ -162,7 +162,7 @@ Although unlikely, some legitimate applications may use a moved copy of rundll32 > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md b/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md index 5a6425156b..5c333ca65b 100644 --- a/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md +++ b/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md @@ -144,7 +144,7 @@ Limited false positives may be present in small environments. Tuning may be requ > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md index 14a6590820..c5fb8b3ffa 100644 --- a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md @@ -146,7 +146,7 @@ Limited false positives may be present in small environments. Tuning may be requ > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md index 7c62bfb06b..d7e6ff4188 100644 --- a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md @@ -146,7 +146,7 @@ Limited false positives may be present in small environments. Tuning may be requ > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md index 6632c5739d..933a8cb6fc 100644 --- a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md @@ -162,7 +162,7 @@ Although unlikely, some legitimate applications may use a moved copy of rundll32 > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md index 376f289a41..6c75b14d70 100644 --- a/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md @@ -145,7 +145,7 @@ Limited false positives may be present in small environments. Tuning may be requ > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md index 5af39a69f0..f012129af1 100644 --- a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md +++ b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md @@ -115,9 +115,9 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: +* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) > :information_source: > **windows_installutil_remote_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -161,7 +161,7 @@ Limited false positives should be present as InstallUtil is not typically used t > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md index f2726ec07a..5204d6ee21 100644 --- a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md +++ b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md @@ -116,9 +116,9 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: +* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) > :information_source: > **windows_installutil_uninstall_option_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -162,7 +162,7 @@ Limited false positives should be present as InstallUtil is not typically used t > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md b/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md index 0faa82a6ea..248502084b 100644 --- a/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md +++ b/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md @@ -138,7 +138,7 @@ administrators may use this command. Filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-22-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2022-03-22-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md index 3ce18c0108..74f5f965b3 100644 --- a/docs/_posts/2022-03-22-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md @@ -100,8 +100,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -134,7 +134,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-22-get_domainuser_with_powershell_script_block.md b/docs/_posts/2022-03-22-get_domainuser_with_powershell_script_block.md index ebd3d9a408..da5c5a0d7a 100644 --- a/docs/_posts/2022-03-22-get_domainuser_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-get_domainuser_with_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **get_domainuser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -139,7 +139,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-22-get_wmiobject_group_discovery_with_script_block_logging.md b/docs/_posts/2022-03-22-get_wmiobject_group_discovery_with_script_block_logging.md index 2f2d286712..3b0d03259d 100644 --- a/docs/_posts/2022-03-22-get_wmiobject_group_discovery_with_script_block_logging.md +++ b/docs/_posts/2022-03-22-get_wmiobject_group_discovery_with_script_block_logging.md @@ -107,8 +107,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **get_wmiobject_group_discovery_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -141,7 +141,7 @@ False positives may be present. Tune as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-22-getadgroup_with_powershell_script_block.md b/docs/_posts/2022-03-22-getadgroup_with_powershell_script_block.md index 965d28a485..d41c63b039 100644 --- a/docs/_posts/2022-03-22-getadgroup_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-getadgroup_with_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getadgroup_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -139,7 +139,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-22-getcurrent_user_with_powershell_script_block.md b/docs/_posts/2022-03-22-getcurrent_user_with_powershell_script_block.md index 0d48777b51..7360d8b806 100644 --- a/docs/_posts/2022-03-22-getcurrent_user_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-getcurrent_user_with_powershell_script_block.md @@ -100,8 +100,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getcurrent_user_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -136,7 +136,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md b/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md index 527557d29e..fce94f7e8c 100644 --- a/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getlocaluser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -135,7 +135,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-22-interactive_session_on_remote_endpoint_with_powershell.md b/docs/_posts/2022-03-22-interactive_session_on_remote_endpoint_with_powershell.md index 36cad457f3..794c52a432 100644 --- a/docs/_posts/2022-03-22-interactive_session_on_remote_endpoint_with_powershell.md +++ b/docs/_posts/2022-03-22-interactive_session_on_remote_endpoint_with_powershell.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **interactive_session_on_remote_endpoint_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -139,7 +139,7 @@ Administrators may leverage WinRM and `Enter-PSSession` for administrative and t > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-22-kerberos_pre-authentication_flag_disabled_with_powershell.md b/docs/_posts/2022-03-22-kerberos_pre-authentication_flag_disabled_with_powershell.md index 9e7b1b8814..1dbda3af81 100644 --- a/docs/_posts/2022-03-22-kerberos_pre-authentication_flag_disabled_with_powershell.md +++ b/docs/_posts/2022-03-22-kerberos_pre-authentication_flag_disabled_with_powershell.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **kerberos_pre-authentication_flag_disabled_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -135,7 +135,7 @@ Although unlikely, Administrators may need to set this flag for legitimate purpo > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-22-powershell_execute_com_object.md b/docs/_posts/2022-03-22-powershell_execute_com_object.md index bac913b29c..18ed9ef03a 100644 --- a/docs/_posts/2022-03-22-powershell_execute_com_object.md +++ b/docs/_posts/2022-03-22-powershell_execute_com_object.md @@ -108,8 +108,8 @@ This search is to detect a COM CLSID execution through powershell. This techniqu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_execute_com_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -140,7 +140,7 @@ network operrator may use this command. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md b/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md index 26b6b3ace2..86b61d0868 100644 --- a/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md +++ b/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md @@ -105,8 +105,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_using_memory_as_backing_store_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -140,7 +140,7 @@ powershell may used this function to store out object into memory. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md b/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md index 02ccb1e84b..41ca8c1dbb 100644 --- a/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md +++ b/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md @@ -100,8 +100,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **recon_avproduct_through_pwh_or_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -136,7 +136,7 @@ network administrator may used this command for checking purposes > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-22-remote_process_instantiation_via_dcom_and_powershell_script_block.md b/docs/_posts/2022-03-22-remote_process_instantiation_via_dcom_and_powershell_script_block.md index 924c75c66b..669000fd6a 100644 --- a/docs/_posts/2022-03-22-remote_process_instantiation_via_dcom_and_powershell_script_block.md +++ b/docs/_posts/2022-03-22-remote_process_instantiation_via_dcom_and_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **remote_process_instantiation_via_dcom_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -139,7 +139,7 @@ Administrators may leverage DCOM to start a process on remote systems, but this > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md b/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md index 4c6450c0f6..e285770d5e 100644 --- a/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md +++ b/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **remote_process_instantiation_via_winrm_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -139,7 +139,7 @@ Administrators may leverage WinRM and `Invoke-Command` to start a process on rem > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-22-user_discovery_with_env_vars_powershell_script_block.md b/docs/_posts/2022-03-22-user_discovery_with_env_vars_powershell_script_block.md index e93bb7ff4e..c4cca2d7ac 100644 --- a/docs/_posts/2022-03-22-user_discovery_with_env_vars_powershell_script_block.md +++ b/docs/_posts/2022-03-22-user_discovery_with_env_vars_powershell_script_block.md @@ -100,8 +100,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **user_discovery_with_env_vars_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -136,7 +136,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-24-splunk_dos_via_malformed_s2s_request.md b/docs/_posts/2022-03-24-splunk_dos_via_malformed_s2s_request.md index a1c1492e33..7b3cd4c163 100644 --- a/docs/_posts/2022-03-24-splunk_dos_via_malformed_s2s_request.md +++ b/docs/_posts/2022-03-24-splunk_dos_via_malformed_s2s_request.md @@ -142,7 +142,7 @@ None. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-28-sql_injection_with_long_urls.md b/docs/_posts/2022-03-28-sql_injection_with_long_urls.md index b69ee2b4c7..f826a17953 100644 --- a/docs/_posts/2022-03-28-sql_injection_with_long_urls.md +++ b/docs/_posts/2022-03-28-sql_injection_with_long_urls.md @@ -151,7 +151,7 @@ It's possible that legitimate traffic will have long URLs or long user agent str > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-28-windows_deleted_registry_by_a_non_critical_process_file_path.md b/docs/_posts/2022-03-28-windows_deleted_registry_by_a_non_critical_process_file_path.md index 58ed5b3bd2..87553e1180 100644 --- a/docs/_posts/2022-03-28-windows_deleted_registry_by_a_non_critical_process_file_path.md +++ b/docs/_posts/2022-03-28-windows_deleted_registry_by_a_non_critical_process_file_path.md @@ -154,7 +154,7 @@ This detection can catch for third party application updates or installation. In > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-28-windows_get-adcomputer_unconstrained_delegation_discovery.md b/docs/_posts/2022-03-28-windows_get-adcomputer_unconstrained_delegation_discovery.md index cc8fa441a4..5b961d19a5 100644 --- a/docs/_posts/2022-03-28-windows_get-adcomputer_unconstrained_delegation_discovery.md +++ b/docs/_posts/2022-03-28-windows_get-adcomputer_unconstrained_delegation_discovery.md @@ -106,8 +106,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_get-adcomputer_unconstrained_delegation_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -140,7 +140,7 @@ Administrators or power users may leverage PowerView for system management or tr > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-28-windows_powerview_unconstrained_delegation_discovery.md b/docs/_posts/2022-03-28-windows_powerview_unconstrained_delegation_discovery.md index c0fd8843c9..3864819c70 100644 --- a/docs/_posts/2022-03-28-windows_powerview_unconstrained_delegation_discovery.md +++ b/docs/_posts/2022-03-28-windows_powerview_unconstrained_delegation_discovery.md @@ -106,8 +106,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_powerview_unconstrained_delegation_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -140,7 +140,7 @@ Administrators or power users may leverage PowerView for system management or tr > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-28-windows_terminating_lsass_process.md b/docs/_posts/2022-03-28-windows_terminating_lsass_process.md index 237644f35a..424eff1d3a 100644 --- a/docs/_posts/2022-03-28-windows_terminating_lsass_process.md +++ b/docs/_posts/2022-03-28-windows_terminating_lsass_process.md @@ -149,7 +149,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md b/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md index 116921f099..d6a31df127 100644 --- a/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md +++ b/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md @@ -157,7 +157,7 @@ False positives may be high depending on the environment and consistent use of I > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md b/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md index d007d1698a..f5be1cf051 100644 --- a/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md +++ b/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md @@ -149,7 +149,7 @@ This analytic is meant to assist with identifying drivers loaded in the environm > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-31-windows_powerview_constrained_delegation_discovery.md b/docs/_posts/2022-03-31-windows_powerview_constrained_delegation_discovery.md index f9c743cfc9..7273292702 100644 --- a/docs/_posts/2022-03-31-windows_powerview_constrained_delegation_discovery.md +++ b/docs/_posts/2022-03-31-windows_powerview_constrained_delegation_discovery.md @@ -106,8 +106,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_powerview_constrained_delegation_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -140,7 +140,7 @@ Administrators or power users may leverage PowerView for system management or tr > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-31-windows_registry_certificate_added.md b/docs/_posts/2022-03-31-windows_registry_certificate_added.md index 5c77608aa7..5fd0bbf3cb 100644 --- a/docs/_posts/2022-03-31-windows_registry_certificate_added.md +++ b/docs/_posts/2022-03-31-windows_registry_certificate_added.md @@ -154,7 +154,7 @@ False positives will be limited to a legitimate business applicating consistentl > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-03-31-windows_registry_modification_for_safe_mode_persistence.md b/docs/_posts/2022-03-31-windows_registry_modification_for_safe_mode_persistence.md index 6a1548f2a6..42dd0062e6 100644 --- a/docs/_posts/2022-03-31-windows_registry_modification_for_safe_mode_persistence.md +++ b/docs/_posts/2022-03-31-windows_registry_modification_for_safe_mode_persistence.md @@ -151,7 +151,7 @@ updated windows application needed in safe boot may used this registry > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md b/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md index de38e044db..cb85c01f90 100644 --- a/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md +++ b/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md @@ -154,7 +154,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md b/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md index 432c7616b9..a49622fd78 100644 --- a/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md +++ b/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md @@ -107,8 +107,8 @@ The following analytic uses Windows EventCode 7045 to identify new Kernel Mode D #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_driver_load_non-standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -142,7 +142,7 @@ False positives may be present based on legitimate third party applications need > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-04-windows_event_for_service_disabled.md b/docs/_posts/2022-04-04-windows_event_for_service_disabled.md index 8cf80a667b..ba8933f81a 100644 --- a/docs/_posts/2022-04-04-windows_event_for_service_disabled.md +++ b/docs/_posts/2022-04-04-windows_event_for_service_disabled.md @@ -112,8 +112,8 @@ This analytic will identify suspicious system event of services that was modifie #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_event_for_service_disabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -147,7 +147,7 @@ Windows service update may cause this event. In that scenario, filtering is need > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-05-java_writing_jsp_file.md b/docs/_posts/2022-04-05-java_writing_jsp_file.md index 6ac6199a03..a77e0be6c5 100644 --- a/docs/_posts/2022-04-05-java_writing_jsp_file.md +++ b/docs/_posts/2022-04-05-java_writing_jsp_file.md @@ -165,7 +165,7 @@ False positives are possible and filtering may be required. Restrict by assets o > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md b/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md index 806039a2f6..20a44c84b6 100644 --- a/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md +++ b/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md @@ -153,7 +153,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-05-spring4shell_payload_url_request.md b/docs/_posts/2022-04-05-spring4shell_payload_url_request.md index 42271ed031..b8f841f9ad 100644 --- a/docs/_posts/2022-04-05-spring4shell_payload_url_request.md +++ b/docs/_posts/2022-04-05-spring4shell_payload_url_request.md @@ -158,7 +158,7 @@ The jsp file names are static names used in current proof of concept code. = > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-05-web_jsp_request_via_url.md b/docs/_posts/2022-04-05-web_jsp_request_via_url.md index d3edad7bf0..1cde456bc1 100644 --- a/docs/_posts/2022-04-05-web_jsp_request_via_url.md +++ b/docs/_posts/2022-04-05-web_jsp_request_via_url.md @@ -158,7 +158,7 @@ False positives may be present with legitimate applications. Attempt to filter b > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-05-web_spring_cloud_function_functionrouter.md b/docs/_posts/2022-04-05-web_spring_cloud_function_functionrouter.md index 233ffda28a..135f9b4bd6 100644 --- a/docs/_posts/2022-04-05-web_spring_cloud_function_functionrouter.md +++ b/docs/_posts/2022-04-05-web_spring_cloud_function_functionrouter.md @@ -148,7 +148,7 @@ False positives may be present with legitimate applications. Attempt to filter b > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md index 78d817612d..0393e4c84c 100644 --- a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md +++ b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md @@ -148,7 +148,7 @@ Some legacy applications may be run using pcalua.exe. Similarly, forfiles.exe ma > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md index f4868dfd77..89de9e7418 100644 --- a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md +++ b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md @@ -148,7 +148,7 @@ Some legacy applications may be run using pcalua.exe. Filter these results as n > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md b/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md index cd549f68af..d73eeffe74 100644 --- a/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md +++ b/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md @@ -150,7 +150,7 @@ False positives may occur and filtering may be required. Restrict analytic to as > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-07-any_powershell_downloadfile.md b/docs/_posts/2022-04-07-any_powershell_downloadfile.md index b02836c531..329d185ff5 100644 --- a/docs/_posts/2022-04-07-any_powershell_downloadfile.md +++ b/docs/_posts/2022-04-07-any_powershell_downloadfile.md @@ -162,7 +162,7 @@ False positives may be present and filtering will need to occur by parent proces > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-07-any_powershell_downloadstring.md b/docs/_posts/2022-04-07-any_powershell_downloadstring.md index 7988f34158..4ed02b76f5 100644 --- a/docs/_posts/2022-04-07-any_powershell_downloadstring.md +++ b/docs/_posts/2022-04-07-any_powershell_downloadstring.md @@ -157,7 +157,7 @@ False positives may be present and filtering will need to occur by parent proces > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-07-detect_html_help_renamed.md b/docs/_posts/2022-04-07-detect_html_help_renamed.md index 6fa7a8e582..6acb966621 100644 --- a/docs/_posts/2022-04-07-detect_html_help_renamed.md +++ b/docs/_posts/2022-04-07-detect_html_help_renamed.md @@ -154,7 +154,7 @@ Although unlikely a renamed instance of hh.exe will be used legitimately, filter > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-07-detect_mshta_renamed.md b/docs/_posts/2022-04-07-detect_mshta_renamed.md index 93eece1173..6c7bb3deb7 100644 --- a/docs/_posts/2022-04-07-detect_mshta_renamed.md +++ b/docs/_posts/2022-04-07-detect_mshta_renamed.md @@ -154,7 +154,7 @@ Although unlikely, some legitimate applications may use a moved copy of mshta.ex > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-07-detect_renamed_psexec.md b/docs/_posts/2022-04-07-detect_renamed_psexec.md index eed5b86c86..db349684ac 100644 --- a/docs/_posts/2022-04-07-detect_renamed_psexec.md +++ b/docs/_posts/2022-04-07-detect_renamed_psexec.md @@ -152,7 +152,7 @@ Limited false positives should be present. It is possible some third party appli > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md b/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md index 1e29bd1de9..8a944454e2 100644 --- a/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md +++ b/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md @@ -161,7 +161,7 @@ Although unlikely, some legitimate applications may use a moved copy of microsof > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-07-suspicious_msbuild_rename.md b/docs/_posts/2022-04-07-suspicious_msbuild_rename.md index b9eaddb521..c2a68c2137 100644 --- a/docs/_posts/2022-04-07-suspicious_msbuild_rename.md +++ b/docs/_posts/2022-04-07-suspicious_msbuild_rename.md @@ -166,7 +166,7 @@ Although unlikely, some legitimate applications may use a moved copy of msbuild, > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-07-suspicious_rundll32_rename.md b/docs/_posts/2022-04-07-suspicious_rundll32_rename.md index 91c0e3235e..ac99111818 100644 --- a/docs/_posts/2022-04-07-suspicious_rundll32_rename.md +++ b/docs/_posts/2022-04-07-suspicious_rundll32_rename.md @@ -164,7 +164,7 @@ Although unlikely, some legitimate applications may use a moved copy of rundll32 > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-12-linux_account_manipulation_of_ssh_config_and_keys.md b/docs/_posts/2022-04-12-linux_account_manipulation_of_ssh_config_and_keys.md index b2e600187b..a74fe596ec 100644 --- a/docs/_posts/2022-04-12-linux_account_manipulation_of_ssh_config_and_keys.md +++ b/docs/_posts/2022-04-12-linux_account_manipulation_of_ssh_config_and_keys.md @@ -167,7 +167,7 @@ Administrator or network operator can execute this command. Please update the fi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-12-linux_deletion_of_cron_jobs.md b/docs/_posts/2022-04-12-linux_deletion_of_cron_jobs.md index 2213e358ff..435922fa30 100644 --- a/docs/_posts/2022-04-12-linux_deletion_of_cron_jobs.md +++ b/docs/_posts/2022-04-12-linux_deletion_of_cron_jobs.md @@ -167,7 +167,7 @@ Administrator or network operator can execute this command. Please update the fi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-12-linux_deletion_of_init_daemon_script.md b/docs/_posts/2022-04-12-linux_deletion_of_init_daemon_script.md index 72aa55766c..960ecca8e6 100644 --- a/docs/_posts/2022-04-12-linux_deletion_of_init_daemon_script.md +++ b/docs/_posts/2022-04-12-linux_deletion_of_init_daemon_script.md @@ -167,7 +167,7 @@ Administrator or network operator can execute this command. Please update the fi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-12-linux_deletion_of_services.md b/docs/_posts/2022-04-12-linux_deletion_of_services.md index acc51b94e3..5c373fb15e 100644 --- a/docs/_posts/2022-04-12-linux_deletion_of_services.md +++ b/docs/_posts/2022-04-12-linux_deletion_of_services.md @@ -167,7 +167,7 @@ Administrator or network operator can execute this command. Please update the fi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-12-linux_deletion_of_ssl_certificate.md b/docs/_posts/2022-04-12-linux_deletion_of_ssl_certificate.md index ee2e06d8f2..21c0aef1d0 100644 --- a/docs/_posts/2022-04-12-linux_deletion_of_ssl_certificate.md +++ b/docs/_posts/2022-04-12-linux_deletion_of_ssl_certificate.md @@ -167,7 +167,7 @@ Administrator or network operator can execute this command. Please update the fi > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-12-linux_high_frequency_of_file_deletion_in_etc_folder.md b/docs/_posts/2022-04-12-linux_high_frequency_of_file_deletion_in_etc_folder.md index 2e881adcba..a8eafe5afc 100644 --- a/docs/_posts/2022-04-12-linux_high_frequency_of_file_deletion_in_etc_folder.md +++ b/docs/_posts/2022-04-12-linux_high_frequency_of_file_deletion_in_etc_folder.md @@ -168,7 +168,7 @@ linux package installer/uninstaller may cause this event. Please update you filt > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md b/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md index d7f366b8a5..12f96affcf 100644 --- a/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md +++ b/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md @@ -155,7 +155,7 @@ False positives should be limited as the activity is not common to delete ONLY t > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md b/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md index 8981efd6d9..4502ff62f6 100644 --- a/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md +++ b/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md @@ -148,7 +148,7 @@ Administrators may use nltest for troubleshooting purposes, otherwise, rarely us > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-22-linux_adding_crontab_using_list_parameter.md b/docs/_posts/2022-04-22-linux_adding_crontab_using_list_parameter.md index 7db1960454..c2a8c673ef 100644 --- a/docs/_posts/2022-04-22-linux_adding_crontab_using_list_parameter.md +++ b/docs/_posts/2022-04-22-linux_adding_crontab_using_list_parameter.md @@ -156,7 +156,7 @@ Administrator or network operator can use this application for automation purpos > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-22-linux_deleting_critical_directory_using_rm_command.md b/docs/_posts/2022-04-22-linux_deleting_critical_directory_using_rm_command.md index c69814f1d1..f5f77d7472 100644 --- a/docs/_posts/2022-04-22-linux_deleting_critical_directory_using_rm_command.md +++ b/docs/_posts/2022-04-22-linux_deleting_critical_directory_using_rm_command.md @@ -146,7 +146,7 @@ Administrator or network operator can use this application for automation purpos > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-22-linux_disable_services.md b/docs/_posts/2022-04-22-linux_disable_services.md index e922726b56..d099ecf726 100644 --- a/docs/_posts/2022-04-22-linux_disable_services.md +++ b/docs/_posts/2022-04-22-linux_disable_services.md @@ -145,7 +145,7 @@ Administrator or network operator can use this application for automation purpos > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-22-linux_high_frequency_of_file_deletion_in_boot_folder.md b/docs/_posts/2022-04-22-linux_high_frequency_of_file_deletion_in_boot_folder.md index f0e85c8005..544f3f8fac 100644 --- a/docs/_posts/2022-04-22-linux_high_frequency_of_file_deletion_in_boot_folder.md +++ b/docs/_posts/2022-04-22-linux_high_frequency_of_file_deletion_in_boot_folder.md @@ -169,7 +169,7 @@ linux package installer/uninstaller may cause this event. Please update you filt > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-22-linux_shred_overwrite_command.md b/docs/_posts/2022-04-22-linux_shred_overwrite_command.md index 9ed11867cb..f1c6a95dc1 100644 --- a/docs/_posts/2022-04-22-linux_shred_overwrite_command.md +++ b/docs/_posts/2022-04-22-linux_shred_overwrite_command.md @@ -147,7 +147,7 @@ Administrator or network operator can use this application for automation purpos > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-22-linux_stop_services.md b/docs/_posts/2022-04-22-linux_stop_services.md index 65fcfb9135..f9ba9a7b71 100644 --- a/docs/_posts/2022-04-22-linux_stop_services.md +++ b/docs/_posts/2022-04-22-linux_stop_services.md @@ -145,7 +145,7 @@ Administrator or network operator can use this application for automation purpos > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md b/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md index c2c28a19e8..b10e220124 100644 --- a/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md +++ b/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md @@ -149,7 +149,7 @@ False positives are possible if legitimate applications are allowed to terminate > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-25-windows_linked_policies_in_adsi_discovery.md b/docs/_posts/2022-04-25-windows_linked_policies_in_adsi_discovery.md index b1a7f26fa3..34af68501f 100644 --- a/docs/_posts/2022-04-25-windows_linked_policies_in_adsi_discovery.md +++ b/docs/_posts/2022-04-25-windows_linked_policies_in_adsi_discovery.md @@ -112,8 +112,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_linked_policies_in_adsi_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -147,7 +147,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-25-windows_root_domain_linked_policies_discovery.md b/docs/_posts/2022-04-25-windows_root_domain_linked_policies_discovery.md index ddf83513ec..db7c76d204 100644 --- a/docs/_posts/2022-04-25-windows_root_domain_linked_policies_discovery.md +++ b/docs/_posts/2022-04-25-windows_root_domain_linked_policies_discovery.md @@ -112,8 +112,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_root_domain_linked_policies_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -147,7 +147,7 @@ Administrators or power users may use this command for troubleshooting. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md b/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md index 90333579f1..41c9d503c8 100644 --- a/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md +++ b/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md @@ -149,7 +149,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-27-splunk_xss_in_monitoring_console.md b/docs/_posts/2022-04-27-splunk_xss_in_monitoring_console.md index 1c46fb9433..5b9c01e73b 100644 --- a/docs/_posts/2022-04-27-splunk_xss_in_monitoring_console.md +++ b/docs/_posts/2022-04-27-splunk_xss_in_monitoring_console.md @@ -143,7 +143,7 @@ Use of the monitoring console where the less-than sign (<) is the first characte > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md b/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md index f01045f1e6..0716084d03 100644 --- a/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md +++ b/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md @@ -146,7 +146,7 @@ It is possible third party applications may have a computer account that adds co > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md b/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md index 2254065a55..6508556aaa 100644 --- a/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md +++ b/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md @@ -145,7 +145,7 @@ It is possible false positives will be present based on third party applications > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md b/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md index e7d7263528..3d6baf3523 100644 --- a/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md +++ b/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md @@ -145,7 +145,7 @@ False positives are possible, filtering may be required to restrict to workstati > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-28-windows_computer_account_with_spn.md b/docs/_posts/2022-04-28-windows_computer_account_with_spn.md index 432c1e8aa7..7c459b8206 100644 --- a/docs/_posts/2022-04-28-windows_computer_account_with_spn.md +++ b/docs/_posts/2022-04-28-windows_computer_account_with_spn.md @@ -148,7 +148,7 @@ It is possible third party applications may add these SPNs to Computer Accounts, > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-29-path_traversal_spl_injection.md b/docs/_posts/2022-04-29-path_traversal_spl_injection.md index cf4726827d..f957c548be 100644 --- a/docs/_posts/2022-04-29-path_traversal_spl_injection.md +++ b/docs/_posts/2022-04-29-path_traversal_spl_injection.md @@ -141,7 +141,7 @@ This search may find additional path traversal exploitation attempts. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-29-splunk_user_enumeration_attempt.md b/docs/_posts/2022-04-29-splunk_user_enumeration_attempt.md index e6b19c860e..04582da67b 100644 --- a/docs/_posts/2022-04-29-splunk_user_enumeration_attempt.md +++ b/docs/_posts/2022-04-29-splunk_user_enumeration_attempt.md @@ -146,7 +146,7 @@ Automation executing authentication attempts against your Splunk infrastructure > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-30-linux_iptables_firewall_modification.md b/docs/_posts/2022-04-30-linux_iptables_firewall_modification.md index 6bc47412ff..f23bcdfdec 100644 --- a/docs/_posts/2022-04-30-linux_iptables_firewall_modification.md +++ b/docs/_posts/2022-04-30-linux_iptables_firewall_modification.md @@ -158,7 +158,7 @@ administrator may do this commandline for auditing and testing purposes. In this > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md b/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md index 5e9fe33916..81557141a0 100644 --- a/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md +++ b/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md @@ -152,7 +152,7 @@ unknown > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md b/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md index 030bf05c8b..50bd382f02 100644 --- a/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md +++ b/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md @@ -108,8 +108,8 @@ The following analytic identifies the default service name created by KrbRelayUp #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_krbrelayup_service_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -143,7 +143,7 @@ False positives should be limited as this is specific to KrbRelayUp based attack > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-05-05-windows_service_create_kernel_mode_driver.md b/docs/_posts/2022-05-05-windows_service_create_kernel_mode_driver.md index 8c0169beb3..7127c9061b 100644 --- a/docs/_posts/2022-05-05-windows_service_create_kernel_mode_driver.md +++ b/docs/_posts/2022-05-05-windows_service_create_kernel_mode_driver.md @@ -159,7 +159,7 @@ False positives may be present based on common applications adding new drivers, > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-05-10-detect_aws_console_login_by_new_user.md b/docs/_posts/2022-05-10-detect_aws_console_login_by_new_user.md index 33ccf452bc..11f1a6b710 100644 --- a/docs/_posts/2022-05-10-detect_aws_console_login_by_new_user.md +++ b/docs/_posts/2022-05-10-detect_aws_console_login_by_new_user.md @@ -139,7 +139,7 @@ When a legitimate new user logins for the first time, this activity will be dete > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-05-10-f5_big-ip_icontrol_rest_vulnerability_cve-2022-1388.md b/docs/_posts/2022-05-10-f5_big-ip_icontrol_rest_vulnerability_cve-2022-1388.md index 61c8a18b13..74fb6f8c97 100644 --- a/docs/_posts/2022-05-10-f5_big-ip_icontrol_rest_vulnerability_cve-2022-1388.md +++ b/docs/_posts/2022-05-10-f5_big-ip_icontrol_rest_vulnerability_cve-2022-1388.md @@ -147,7 +147,7 @@ False positives may be present if the activity is blocked or was not successful. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md b/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md index eb233f9012..484b31b7fd 100644 --- a/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md +++ b/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md @@ -146,7 +146,7 @@ The idea of using named pipes with Cobalt Strike is to blend in. Therefore, some > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-05-16-windows_system_file_on_disk.md b/docs/_posts/2022-05-16-windows_system_file_on_disk.md index 3e06cdcbdd..a4469a0c63 100644 --- a/docs/_posts/2022-05-16-windows_system_file_on_disk.md +++ b/docs/_posts/2022-05-16-windows_system_file_on_disk.md @@ -147,7 +147,7 @@ False positives will be present. Filter as needed. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-05-17-aws_create_policy_version_to_allow_all_resources.md b/docs/_posts/2022-05-17-aws_create_policy_version_to_allow_all_resources.md index 95f1019282..1120aa4fd0 100644 --- a/docs/_posts/2022-05-17-aws_create_policy_version_to_allow_all_resources.md +++ b/docs/_posts/2022-05-17-aws_create_policy_version_to_allow_all_resources.md @@ -121,8 +121,8 @@ This search looks for AWS CloudTrail events where a user created a policy versio #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **aws_create_policy_version_to_allow_all_resources_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -160,7 +160,7 @@ While this search has no known false positives, it is possible that an AWS admin > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-05-19-vmware_server_side_template_injection_hunt.md b/docs/_posts/2022-05-19-vmware_server_side_template_injection_hunt.md index d31345e5e3..6e326e83ee 100644 --- a/docs/_posts/2022-05-19-vmware_server_side_template_injection_hunt.md +++ b/docs/_posts/2022-05-19-vmware_server_side_template_injection_hunt.md @@ -147,7 +147,7 @@ False positives may be present if the activity is blocked or was not successful. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-05-19-vmware_workspace_one_freemarker_server-side_template_injection.md b/docs/_posts/2022-05-19-vmware_workspace_one_freemarker_server-side_template_injection.md index c6bcef3597..de6960c9ba 100644 --- a/docs/_posts/2022-05-19-vmware_workspace_one_freemarker_server-side_template_injection.md +++ b/docs/_posts/2022-05-19-vmware_workspace_one_freemarker_server-side_template_injection.md @@ -147,7 +147,7 @@ False positives may be present if the activity is blocked or was not successful. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-05-23-schtasks_scheduling_job_on_remote_system.md b/docs/_posts/2022-05-23-schtasks_scheduling_job_on_remote_system.md index f6dd72bb0b..faa65f5472 100644 --- a/docs/_posts/2022-05-23-schtasks_scheduling_job_on_remote_system.md +++ b/docs/_posts/2022-05-23-schtasks_scheduling_job_on_remote_system.md @@ -152,7 +152,7 @@ Administrators may create scheduled tasks on remote systems, but this activity i > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-05-26-linux_at_application_execution.md b/docs/_posts/2022-05-26-linux_at_application_execution.md index b5f03fb2f5..6ab7c3618b 100644 --- a/docs/_posts/2022-05-26-linux_at_application_execution.md +++ b/docs/_posts/2022-05-26-linux_at_application_execution.md @@ -155,7 +155,7 @@ Administrator or network operator can use this application for automation purpos > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-05-26-linux_possible_append_command_to_at_allow_config_file.md b/docs/_posts/2022-05-26-linux_possible_append_command_to_at_allow_config_file.md index 186585638e..460b2cc15f 100644 --- a/docs/_posts/2022-05-26-linux_possible_append_command_to_at_allow_config_file.md +++ b/docs/_posts/2022-05-26-linux_possible_append_command_to_at_allow_config_file.md @@ -155,7 +155,7 @@ Administrator or network operator can use this commandline for automation purpos > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference diff --git a/docs/_posts/2022-05-26-macos_plutil.md b/docs/_posts/2022-05-26-macos_plutil.md index 7d207f05b0..9d7140b763 100644 --- a/docs/_posts/2022-05-26-macos_plutil.md +++ b/docs/_posts/2022-05-26-macos_plutil.md @@ -146,7 +146,7 @@ Administrators using plutil to change plist files. > :information_source: -> The Risk Score is calculated by the following formula: Risk Score = (**Impact** * **Confidence**/100). Initial Confidence and Impact is set by the analytic author. +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. #### Reference From 96a391dbc9dfbdb2032e7f1b236b3dce50a94a0b Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 31 May 2022 10:38:13 -0500 Subject: [PATCH 052/148] Updating DM --- .../splunk_command_and_scripting_interpreter_delete_usage.yml | 2 +- .../splunk_command_and_scripting_interpreter_risky_commands.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml index 2bfdd6f358..c04a9f5562 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml @@ -5,7 +5,7 @@ date: '2022-05-27' author: Michael Haag, Splunk type: Anomaly datamodel: -- Endpoint +- Splunk_Audit description: The following analytic identifies the use of the risky command - Delete - that may be utilized in Splunk to delete some or all data queried for. In order to use Delete in Splunk, one must be assigned the role. This is typically not used and should generate an anomaly if it is used. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| delete*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml index 84d03de18b..f940895bc3 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml @@ -5,7 +5,7 @@ date: '2022-05-23' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Splunk_Audit description: 'The Splunk platform contains built-in search processing language (SPL) safeguards to warn you when you are about to unknowingly run a search that contains commands that might be a security risk. This warning appears when you click a link or type a URL that loads a search that contains risky commands. The warning does not appear when you create ad hoc searches. This warning alerts you to the possibility of unauthorized actions by a malicious user. Unauthorized actions include - Copying or transferring data (data exfiltration), Deleting data and Overwriting data. A possible scenario when this might occur is when a malicious person creates a search that includes commands that exfiltrate or damage data. The malicious person then sends an unsuspecting user a link to the search. The URL contains a query string (q) and a search identifier (sid), but the sid is not valid. The malicious person hopes the user will use the link and the search will run. From c7ad4a013b67f09fd2120a851a9fcdcc128d1eba Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 31 May 2022 10:58:08 -0500 Subject: [PATCH 053/148] Updating DM enum --- .../contentctl_core/domain/entities/enums/enums.py | 1 + 1 file changed, 1 insertion(+) diff --git a/bin/contentctl_project/contentctl_core/domain/entities/enums/enums.py b/bin/contentctl_project/contentctl_core/domain/entities/enums/enums.py index 848e8f176d..6b68f5049b 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/enums/enums.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/enums/enums.py @@ -24,6 +24,7 @@ class DataModel(enum.Enum): Endpoint_Filesystem = 14 Endpoint_Registry = 15 Risk = 16 + Splunk_Audit = 17 class SecurityContentType(enum.Enum): detections = 1 From b1c1c43a01f6eea29e7b4817aff352271afd00fd Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 31 May 2022 10:10:07 -0700 Subject: [PATCH 054/148] Update windows_command_and_scripting_interpreter_path_traversal_exec.yml --- ..._command_and_scripting_interpreter_path_traversal_exec.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml index 1d67eb41ca..0644a91e53 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml @@ -22,14 +22,14 @@ how_to_implement: To successfully implement this search you need to be ingesting your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product -known_false_positives: unknown +known_false_positives: Not known at this moment. references: - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ tags: analytic_story: - Windows Defense Evasion Tactics - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 - asset_type: UPDATE asset_type + asset_type: Endpoint cis20: - CIS 3 - CIS 5 From 376d1f2943ef5f13a1ac9305c2f43926acc1d4af Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 31 May 2022 11:12:24 -0600 Subject: [PATCH 055/148] filter note --- .../endpoint/windows_execute_arbitrary_commands_with_msdt.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml index 8edf5cb667..7b1e061c6b 100644 --- a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml +++ b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml @@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_execute_arbitrary_commands_with_msdt_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives may be present based on +known_false_positives: False positives may be present, filter as needed. references: - https://isc.sans.edu/diary/rss/28694 - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e @@ -84,4 +84,4 @@ tags: - Processes.process_path - Processes.parent_process_id risk_score: 100 - security_domain: endpoint \ No newline at end of file + security_domain: endpoint From aa490411d4638b7b1938197bed205812c1e05178 Mon Sep 17 00:00:00 2001 From: research bot Date: Tue, 31 May 2022 18:14:42 +0000 Subject: [PATCH 056/148] updating docs and package bits [ci skip] --- dist/escu/app.manifest | 2 +- dist/escu/default/analyticstories.conf | 55 ++++- dist/escu/default/app.conf | 4 +- dist/escu/default/collections.conf | 2 +- dist/escu/default/content-version.conf | 2 +- dist/escu/default/es_investigations.conf | 2 +- dist/escu/default/macros.conf | 14 +- dist/escu/default/savedsearches.conf | 164 +++++++++++++-- dist/escu/default/transforms.conf | 2 +- dist/escu/default/workflow_actions.conf | 2 +- dist/escu/lookups/mitre_enrichment.csv | 196 +++++++++--------- docs/_pages/detections.md | 3 + docs/_pages/stories.md | 3 +- ...spectre_and_meltdown_vulnerable_systems.md | 2 +- ...12-detect_new_login_attempts_to_routers.md | 2 +- ...9-15-no_windows_updates_in_a_time_frame.md | 2 +- ...9-email_attachments_with_lots_of_spaces.md | 2 +- ...s_scanning_for_vulnerable_jboss_servers.md | 2 +- ...cious_requests_to_exploit_jboss_servers.md | 2 +- .../2017-09-23-monitor_dns_for_brand_abuse.md | 4 +- ...-23-monitor_web_traffic_for_brand_abuse.md | 2 +- .../2017-11-27-detect_usb_device_insertion.md | 2 +- ...018-01-05-monitor_email_for_brand_abuse.md | 2 +- ...nce_started_in_previously_unseen_region.md | 2 +- ...ance_started_with_previously_unseen_ami.md | 2 +- ...16-detect_new_api_calls_from_user_roles.md | 2 +- ...detect_spike_in_security_group_activity.md | 2 +- ...ect_api_activity_from_users_without_mfa.md | 2 +- ...21-detect_spike_in_network_acl_activity.md | 2 +- ...6-01-detect_large_outbound_icmp_packets.md | 2 +- ...-10-23-wmi_permanent_event_subscription.md | 2 +- ...-10-23-wmi_temporary_event_subscription.md | 2 +- ...8-11-02-windows_hosts_file_modification.md | 2 +- .../2018-12-03-remote_wmi_command_attempt.md | 4 +- .../_posts/2018-12-03-usn_journal_deletion.md | 2 +- .../2018-12-06-suspicious_java_classes.md | 2 +- .../2018-12-14-file_with_samsam_extension.md | 2 +- .../2018-12-14-samsam_test_file_write.md | 2 +- ...ikatz_via_powershell_and_eventcode_4703.md | 2 +- ...ide_files_directories_via_registry_keys.md | 2 +- ..._servers_executing_suspicious_processes.md | 2 +- .../2019-04-25-suspicious_file_write.md | 4 +- ...5-08-unusually_long_command_line_-_mltk.md | 2 +- ...9-10-11-prohibited_software_on_endpoint.md | 4 +- .../2019-12-10-creation_of_shadow_copy.md | 2 +- ...-01-22-dns_query_length_outliers_-_mltk.md | 2 +- ...ed_with_previously_unseen_instance_type.md | 2 +- ...20-02-07-macos_-_re-opened_applications.md | 2 +- .../2020-02-21-dump_lsass_via_comsvcs_dll.md | 4 +- ...03-02-remote_registry_key_modifications.md | 2 +- ...20-03-16-child_processes_of_spoolsv_exe.md | 2 +- .../2020-03-16-detect_rare_executables.md | 2 +- .../2020-03-16-process_execution_via_wmi.md | 2 +- .../2020-03-16-script_execution_via_wmi.md | 2 +- ...5-gcp_kubernetes_cluster_scan_detection.md | 2 +- ...0-first_time_seen_child_process_of_zoom.md | 2 +- ...interception_by_creation_of_program_exe.md | 2 +- ...2020-07-06-short_lived_windows_accounts.md | 2 +- .../2020-07-06-windows_event_log_cleared.md | 2 +- ...20-07-07-remote_desktop_network_traffic.md | 2 +- ...20-07-08-detect_new_local_admin_account.md | 2 +- ...-07-21-attempt_to_stop_security_service.md | 2 +- ...api_activities_from_unapproved_accounts.md | 2 +- ..._to_phishing_sites_leveraging_evilginx2.md | 6 +- ...-detect_excessive_user_account_lockouts.md | 2 +- ...-21-detect_long_dns_txt_record_response.md | 2 +- ...07-21-detect_new_user_aws_console_login.md | 2 +- .../2020-07-21-detect_outbound_smb_traffic.md | 2 +- ...1-detect_outlook_exe_writing_a_zip_file.md | 2 +- ...f_cmd_exe_to_launch_script_interpreters.md | 2 +- ...web_traffic_to_dynamic_domain_providers.md | 4 +- ...-21-detection_of_tools_built_by_nirsoft.md | 2 +- ...ce_modified_with_previously_unseen_user.md | 2 +- ...nce_started_with_previously_unseen_user.md | 2 +- ...ritten_outside_of_the_outlook_directory.md | 2 +- ...1-first_time_seen_command_line_argument.md | 2 +- ...first_time_seen_running_windows_service.md | 2 +- ...g_files_and_directories_with_attrib_exe.md | 2 +- ...shell_process_-_execution_policy_bypass.md | 2 +- ...th_invalid_credentials_from_the_same_ip.md | 2 +- .../2020-07-21-okta_failed_sso_attempts.md | 2 +- ...1-okta_user_logins_from_multiple_cities.md | 2 +- ...7-21-overwriting_accessibility_binaries.md | 2 +- ...7-21-prohibited_network_traffic_allowed.md | 2 +- .../2020-07-21-protocol_or_port_mismatch.md | 2 +- ...emote_desktop_process_running_on_system.md | 2 +- ...21-sc_exe_manipulating_windows_services.md | 2 +- ...uled_tasks_used_in_badrabbit_ransomware.md | 2 +- ...suspicious_changes_to_file_associations.md | 2 +- ...20-07-22-suspicious_email_-_uba_anomaly.md | 2 +- ...-suspicious_email_attachment_extensions.md | 2 +- .../2020-07-22-suspicious_reg_exe_process.md | 2 +- docs/_posts/2020-07-22-tor_traffic.md | 2 +- ...20-07-22-uncommon_processes_on_endpoint.md | 2 +- .../2020-07-22-unload_sysmon_filter_driver.md | 2 +- ...ance_modified_by_previously_unseen_user.md | 2 +- ...oud_network_access_control_list_deleted.md | 2 +- ..._or_delete_windows_shares_using_net_exe.md | 2 +- ...tivity_related_to_pass_the_hash_attacks.md | 2 +- ...ect_software_download_to_network_device.md | 2 +- .../2020-11-06-ryuk_test_files_detected.md | 2 +- ...windows_connhost_exe_started_forcefully.md | 2 +- ...indows_security_account_manager_stopped.md | 2 +- ...2020-11-09-common_ransomware_extensions.md | 2 +- .../2020-11-09-common_ransomware_notes.md | 2 +- .../2020-11-09-deleting_shadow_copies.md | 2 +- ...xcessive_account_lockouts_from_endpoint.md | 2 +- ..._system_network_configuration_discovery.md | 2 +- ...rohibited_applications_spawning_cmd_exe.md | 2 +- ...cution_of_file_with_multiple_extensions.md | 2 +- ...on_of_file_with_spaces_before_extension.md | 2 +- .../2020-11-23-processes_created_by_netsh.md | 2 +- ...installation_with_suspicious_parameters.md | 2 +- ...pulating_windows_services_registry_keys.md | 2 +- ...2-07-schtasks_used_for_forcing_a_reboot.md | 2 +- .../2020-12-08-shim_database_file_creation.md | 2 +- ...12-08-single_letter_process_on_endpoint.md | 2 +- ...processes_run_from_unexpected_locations.md | 2 +- .../2020-12-08-unusually_long_command_line.md | 2 +- ...12-15-o365_suspicious_rights_delegation.md | 2 +- .../2020-12-16-o365_pst_export_alert.md | 2 +- ...-o365_suspicious_admin_email_forwarding.md | 2 +- ...6-o365_suspicious_user_email_forwarding.md | 2 +- ...1-bcdedit_failure_recovery_modification.md | 2 +- ...ng_keys_with_encrypt_policy_without_mfa.md | 2 +- ..._with_kms_keys_performing_encryption_s3.md | 2 +- ...ontrol_list_created_with_all_open_ports.md | 2 +- ...aws_network_access_control_list_deleted.md | 2 +- ...cious_microsoft_workflow_compiler_usage.md | 4 +- .../2021-01-12-suspicious_msbuild_spawn.md | 2 +- ...21-01-12-suspicious_mshta_child_process.md | 2 +- ..._connecting_to_dynamic_domain_providers.md | 2 +- ...ell_process_with_obfuscation_techniques.md | 2 +- ...cious_powershell_command-line_arguments.md | 2 +- ...20-detect_rundll32_inline_hta_execution.md | 4 +- .../2021-01-20-suspicious_mshta_spawn.md | 2 +- ...021-01-22-wbadmin_delete_system_backups.md | 2 +- ...l_access_by_provider_user_and_principal.md | 2 +- ...01-26-aws_saml_update_identity_provider.md | 2 +- ...-26-certutil_exe_certificate_extraction.md | 2 +- ...o365_add_app_role_assignment_grant_user.md | 2 +- ...1-01-26-o365_excessive_sso_logon_errors.md | 2 +- ...1-01-26-o365_new_federated_domain_added.md | 2 +- .../_posts/2021-01-28-ntdsutil_export_ntds.md | 2 +- ...32_application_control_bypass_-_advpack.md | 4 +- ...2_application_control_bypass_-_setupapi.md | 4 +- ...2_application_control_bypass_-_syssetup.md | 4 +- .../2021-02-04-suspicious_rundll32_startw.md | 4 +- ...9-suspicious_rundll32_dllregisterserver.md | 4 +- ...11-detect_html_help_spawn_child_process.md | 2 +- ...-02-12-detect_regasm_spawning_a_process.md | 2 +- ...02-12-detect_regsvcs_spawning_a_process.md | 2 +- ...2-22-suspicious_curl_network_connection.md | 2 +- .../2021-02-22-suspicious_plistbuddy_usage.md | 2 +- ...uspicious_sqlite3_lsquarantine_behavior.md | 2 +- .../_posts/2021-03-01-fodhelper_uac_bypass.md | 2 +- .../2021-03-01-ryuk_wake_on_lan_command.md | 2 +- ...us_scheduled_task_from_public_directory.md | 2 +- .../2021-03-02-aws_setdefaultpolicyversion.md | 2 +- ...ed_messaging_service_spawning_a_process.md | 2 +- ...-02-windows_disableantispyware_registry.md | 2 +- ...2021-03-03-nishang_powershelltcponeline.md | 2 +- docs/_posts/2021-03-03-w3wp_spawning_shell.md | 4 +- .../2021-03-12-resize_shadowstorage_volume.md | 2 +- .../2021-03-17-clop_common_exec_parameter.md | 2 +- ...3-17-clop_ransomware_known_service_name.md | 2 +- ...021-03-23-certutil_with_decode_argument.md | 2 +- ...021-03-29-powershell_start-bitstransfer.md | 2 +- ...03-31-aws_iam_successful_group_deletion.md | 2 +- ...021-03-31-disabling_firewall_with_netsh.md | 4 +- .../2021-03-31-dsquery_domain_discovery.md | 2 +- ...-aws_iam_assume_role_policy_brute_force.md | 2 +- .../2021-04-01-aws_iam_delete_policy.md | 2 +- ...21-04-01-aws_iam_failure_group_deletion.md | 2 +- ...icious_powershell_executed_as_a_service.md | 2 +- ...heduled_task_created_within_public_path.md | 2 +- .../2021-04-12-excel_spawning_powershell.md | 2 +- ...4-12-excel_spawning_windows_script_host.md | 2 +- ...t_scheduled_task_created_to_spawn_shell.md | 2 +- .../2021-04-12-winword_spawning_powershell.md | 2 +- ...12-winword_spawning_windows_script_host.md | 2 +- ...1-04-13-aws_excessive_security_scanning.md | 2 +- ...fice_application_spawn_rundll32_process.md | 4 +- ...-15-dns_exfiltration_using_nslookup_app.md | 2 +- ...hedule_task_with_http_command_arguments.md | 2 +- ...dule_task_with_rundll32_command_trigger.md | 2 +- ...ocess_spawned_cmd_or_powershell_process.md | 4 +- ...ultiple_archive_files_http_post_traffic.md | 2 +- .../2021-04-22-anomalous_usage_of_7zip.md | 2 +- ...e_product_spawning_rundll32_with_no_dll.md | 4 +- ...-04-22-plain_http_post_exfiltrated_data.md | 2 +- .../_posts/2021-04-22-winword_spawning_cmd.md | 2 +- ...04-26-office_product_spawning_bitsadmin.md | 4 +- ...-04-26-office_product_spawning_certutil.md | 2 +- ...021-04-26-office_product_spawning_mshta.md | 2 +- docs/_posts/2021-04-29-icacls_deny_command.md | 2 +- .../2021-05-04-deleting_of_net_users.md | 2 +- .../2021-05-04-disabling_net_user_account.md | 2 +- ...4-excessive_attempt_to_disable_services.md | 2 +- ...21-05-04-excessive_service_stop_attempt.md | 2 +- .../2021-05-04-excessive_usage_of_taskkill.md | 2 +- .../_posts/2021-05-04-icacls_grant_command.md | 2 +- ...21-05-04-process_kill_base_on_file_path.md | 4 +- ...2021-05-05-suspicious_process_file_path.md | 2 +- ...merate_users_local_group_using_telegram.md | 2 +- .../2021-05-06-excessive_usage_of_net_app.md | 2 +- ...s_or_script_creation_in_suspicious_path.md | 2 +- ...2021-05-07-excessive_usage_of_cacls_app.md | 2 +- .../2021-05-07-schtasks_run_task_on_demand.md | 2 +- ...05-12-delete_shadowcopy_with_powershell.md | 2 +- docs/_posts/2021-05-13-slui_runas_elevated.md | 2 +- .../2021-05-13-slui_spawning_a_process.md | 2 +- .../2021-05-18-services_escalate_exe.md | 2 +- ...-allow_inbound_traffic_in_firewall_rule.md | 2 +- .../2021-05-19-mailsniper_invoke_functions.md | 2 +- .../2021-05-20-cmd_echo_pipe_-_escalation.md | 2 +- .../2021-05-21-winrm_spawning_a_process.md | 2 +- ...6-secretdumps_offline_ntds_dumping_tool.md | 2 +- ...27-detect_sharphound_file_modifications.md | 2 +- .../2021-05-27-detect_sharphound_usage.md | 2 +- ...etect_azurehound_command-line_arguments.md | 2 +- ...01-detect_azurehound_file_modifications.md | 2 +- ...etect_sharphound_command-line_arguments.md | 2 +- .../2021-06-02-conti_common_exec_parameter.md | 2 +- .../2021-06-02-revil_common_exec_parameter.md | 2 +- ...-04-known_services_killed_by_ransomware.md | 2 +- ...-excessive_number_of_taskhost_processes.md | 2 +- ...ss_process_injection_via_getprocaddress.md | 2 +- ..._script_contains_base64_encoded_content.md | 2 +- ...re_with_powershell_script_block_logging.md | 2 +- ...tz_with_powershell_script_block_logging.md | 2 +- ...021-06-09-unloading_amsi_via_reflection.md | 2 +- ...ear_unallocated_sector_using_cipher_app.md | 2 +- .../2021-06-10-disable_logs_using_wevtutil.md | 2 +- ...rmission_modification_using_takeown_app.md | 2 +- ...-06-10-powershell_creating_thread_mutex.md | 2 +- ...021-06-10-powershell_domain_enumeration.md | 2 +- ...ading_dotnet_into_memory_via_reflection.md | 2 +- ...10-powershell_processing_stream_of_data.md | 2 +- ...ent_automatic_repair_mode_using_bcdedit.md | 2 +- .../2021-06-10-recon_using_wmi_class.md | 2 +- ...4-wmi_recon_running_process_or_services.md | 2 +- ...7-suspicious_event_log_service_behavior.md | 2 +- ...ecute_javascript_with_jscript_com_clsid.md | 2 +- ...-powershell_enable_smb1protocol_feature.md | 2 +- ...ursive_delete_of_directory_in_batch_cmd.md | 2 +- ...w_file_and_printing_sharing_in_firewall.md | 4 +- ...-23-allow_network_discovery_in_firewall.md | 4 +- ...er_of_service_control_start_as_disabled.md | 2 +- ...1-print_spooler_adding_a_printer_driver.md | 2 +- ...-print_spooler_failed_to_load_a_plug-in.md | 2 +- .../2021-07-01-spoolsv_spawning_rundll32.md | 4 +- ...05-msmpeng_application_dll_side_loading.md | 2 +- ...-powershell_disable_security_monitoring.md | 2 +- ...tance_created_by_previously_unseen_user.md | 2 +- .../2021-07-19-aws_createloginprofile.md | 2 +- .../2021-07-19-detect_new_open_s3_buckets.md | 2 +- ...detect_new_open_s3_buckets_over_aws_cli.md | 2 +- ...a_spawning_rundll32_or_regsvr32_process.md | 2 +- ...-07-19-office_product_spawn_cmd_process.md | 2 +- ...of_shadowcopy_with_script_block_logging.md | 2 +- ...7-26-suspicious_icedid_rundll32_cmdline.md | 4 +- ...21-07-26-suspicious_rundll32_plugininit.md | 4 +- .../2021-07-27-chcp_command_execution.md | 2 +- .../2021-08-09-uninstall_app_using_msiexec.md | 2 +- docs/_posts/2021-08-11-fsutil_zeroing_file.md | 2 +- ...8-17-7zip_commandline_to_smb_share_path.md | 2 +- ...ws_ecr_container_scanning_findings_high.md | 2 +- ...ning_findings_low_informational_unknown.md | 2 +- ..._ecr_container_scanning_findings_medium.md | 2 +- docs/_posts/2021-08-18-esentutl_sam_copy.md | 2 +- ...container_upload_outside_business_hours.md | 2 +- ...9-aws_ecr_container_upload_unknown_user.md | 2 +- ...ols_passing_authentication_in_cleartext.md | 2 +- ...2021-08-20-kubernetes_nginx_ingress_lfi.md | 2 +- ...2021-08-23-getlocaluser_with_powershell.md | 2 +- ...twmiobject_user_account_with_powershell.md | 2 +- ...er_account_with_powershell_script_block.md | 2 +- ...2021-08-23-kubernetes_nginx_ingress_rfi.md | 2 +- ...21-08-24-adsisearcher_account_discovery.md | 2 +- ...4-domain_account_discovery_with_dsquery.md | 2 +- ...4-domain_account_discovery_with_net_app.md | 2 +- ...8-24-domain_account_discovery_with_wmic.md | 2 +- ...1-08-24-get-domaintrust_with_powershell.md | 2 +- ...omaintrust_with_powershell_script_block.md | 2 +- .../2021-08-24-get_aduser_with_powershell.md | 2 +- ...get_aduser_with_powershell_script_block.md | 2 +- ...21-08-24-get_domainuser_with_powershell.md | 2 +- ...24-getwmiobject_ds_user_with_powershell.md | 2 +- ...ct_ds_user_with_powershell_script_block.md | 2 +- ...omain_group_discovery_with_adsisearcher.md | 2 +- ...1-08-25-domain_group_discovery_with_net.md | 2 +- ...-08-25-domain_group_discovery_with_wmic.md | 2 +- ...08-25-elevated_group_discovery_with_net.md | 2 +- ...elevated_group_discovery_with_powerview.md | 2 +- ...8-25-elevated_group_discovery_with_wmic.md | 2 +- .../2021-08-25-getadgroup_with_powershell.md | 2 +- ...21-08-25-getdomaingroup_with_powershell.md | 2 +- ...-25-getnettcpconnection_with_powershell.md | 2 +- ...5-getwmiobject_ds_group_with_powershell.md | 2 +- ...t_ds_group_with_powershell_script_block.md | 2 +- ...ultdomainpasswordpolicy_with_powershell.md | 2 +- ...resultantpasswordpolicy_with_powershell.md | 2 +- ...wordpolicy_with_powershell_script_block.md | 2 +- ...-08-26-get_domainpolicy_with_powershell.md | 2 +- ...mainpolicy_with_powershell_script_block.md | 2 +- ...omaingroup_with_powershell_script_block.md | 2 +- ...8-26-password_policy_discovery_with_net.md | 2 +- ...reating_lnk_file_in_suspicious_location.md | 2 +- ...-08-27-exchange_powershell_module_usage.md | 2 +- ...domain_controller_discovery_with_nltest.md | 2 +- ...-08-30-remote_system_discovery_with_net.md | 2 +- ...petitpotam_network_share_access_request.md | 2 +- ...itpotam_suspicious_kerberos_tgt_request.md | 2 +- ...31-remote_system_discovery_with_dsquery.md | 2 +- ...1-domain_controller_discovery_with_wmic.md | 2 +- ...-01-domain_group_discovery_with_dsquery.md | 2 +- ...adcomputer_with_powershell_script_block.md | 2 +- ...s_computer_with_powershell_script_block.md | 2 +- ...1-github_pull_request_from_unknown_user.md | 2 +- ...mote_system_discovery_with_adsisearcher.md | 2 +- ...09-01-remote_system_discovery_with_wmic.md | 2 +- ...1-09-02-get-foresttrust_with_powershell.md | 2 +- ...oresttrust_with_powershell_script_block.md | 2 +- ...incomputer_with_powershell_script_block.md | 2 +- ...controller_with_powershell_script_block.md | 2 +- ...cdedit_command_back_to_normal_mode_boot.md | 2 +- ...change_to_safe_mode_with_network_config.md | 2 +- ...021-09-07-getadcomputer_with_powershell.md | 2 +- ...09-07-getdomaincomputer_with_powershell.md | 2 +- ...-07-getdomaincontroller_with_powershell.md | 2 +- ...etwmiobject_ds_computer_with_powershell.md | 2 +- ...-system_information_discovery_detection.md | 2 +- ...l_loading_from_world_writable_directory.md | 2 +- ...eate_local_admin_accounts_using_net_exe.md | 2 +- .../2021-09-08-office_spawning_control.md | 2 +- ...2021-09-08-rundll32_control_rundll_hunt.md | 4 +- ...control_rundll_world_writable_directory.md | 4 +- ...connection_with_powershell_script_block.md | 2 +- ...0-network_connection_discovery_with_arp.md | 2 +- ...0-network_connection_discovery_with_net.md | 2 +- ...twork_connection_discovery_with_netstat.md | 2 +- ...1-09-13-getcurrent_user_with_powershell.md | 2 +- ...-13-jscript_execution_using_cscript_app.md | 2 +- ...-09-13-system_user_discovery_with_query.md | 2 +- ...09-13-system_user_discovery_with_whoami.md | 2 +- ...user_discovery_with_env_vars_powershell.md | 2 +- ...21-09-13-xsl_script_execution_with_wmic.md | 4 +- ...-cmdline_tool_not_executed_in_cmd_shell.md | 2 +- ...021-09-14-get_wmiobject_group_discovery.md | 2 +- .../2021-09-14-net_localgroup_discovery.md | 2 +- ...-14-powershell_get_localgroup_discovery.md | 2 +- ...oup_discovery_with_script_block_logging.md | 2 +- .../_posts/2021-09-14-wmic_group_discovery.md | 2 +- ...1-09-15-check_elevated_cmd_using_whoami.md | 2 +- ...me_process_accessing_chrome_default_dir.md | 2 +- ...efox_process_access_firefox_profile_dir.md | 2 +- ...21-09-16-account_discovery_with_net_app.md | 2 +- ...t_to_add_certificate_to_untrusted_store.md | 2 +- ...edential_dump_from_registry_via_reg_exe.md | 2 +- .../_posts/2021-09-16-bits_job_persistence.md | 4 +- .../2021-09-16-bitsadmin_download_file.md | 4 +- ...of_shadow_copy_with_wmic_and_powershell.md | 4 +- ...mping_via_copy_command_from_shadow_copy.md | 2 +- ...tial_dumping_via_symlink_to_shadow_copy.md | 2 +- ...16-detect_html_help_url_in_command_line.md | 2 +- ...ml_help_using_infotech_storage_handlers.md | 2 +- ...09-16-detect_mshta_inline_hta_execution.md | 2 +- ...-09-16-detect_mshta_url_in_command_line.md | 2 +- ...9-16-detect_psexec_with_accepteula_flag.md | 2 +- .../_posts/2021-09-16-detect_renamed_7-zip.md | 2 +- .../2021-09-16-detect_renamed_rclone.md | 2 +- .../2021-09-16-detect_renamed_winrar.md | 2 +- .../2021-09-16-dump_lsass_via_procdump.md | 2 +- ...-09-16-local_account_discovery_with_net.md | 2 +- ...09-16-local_account_discovery_with_wmic.md | 4 +- ...2021-09-16-office_product_spawning_wmic.md | 4 +- .../2021-09-16-processes_launching_netsh.md | 4 +- ...ument_spawned_child_process_to_download.md | 2 +- ...mcos_rat_file_creation_in_remcos_folder.md | 2 +- ...1-09-27-change_default_file_association.md | 2 +- ...27-logon_script_event_trigger_execution.md | 2 +- ...-27-screensaver_event_trigger_execution.md | 2 +- ...9-28-print_processor_registry_autostart.md | 2 +- .../2021-09-29-verclsid_clsid_execution.md | 2 +- ...01-vbscript_execution_using_wscript_app.md | 2 +- ...ld_suspicious_spawned_by_script_process.md | 2 +- ...5-malicious_inprocserver32_modification.md | 2 +- ...1-10-05-process_writing_dynamicwrapperx.md | 2 +- .../2021-10-05-rundll32_shimcache_flush.md | 4 +- .../2021-10-05-winhlp32_spawning_a_process.md | 2 +- ...021-10-06-sdelete_application_execution.md | 4 +- ...ipt_or_cscript_suspicious_child_process.md | 2 +- .../2021-10-11-suspicious_wevtutil_usage.md | 2 +- ...rincipalnames_discovery_with_powershell.md | 2 +- ...iceprincipalnames_discovery_with_setspn.md | 2 +- .../2021-10-18-disable_schedule_task.md | 2 +- ...indows_curl_download_to_suspicious_path.md | 2 +- ...ows_task_scheduler_event_action_started.md | 2 +- ...-wmic_noninteractive_app_uninstallation.md | 2 +- docs/_posts/2021-11-03-windows_adfind_exe.md | 2 +- .../2021-11-04-attacker_tools_on_endpoint.md | 2 +- ...ndows_curl_upload_to_remote_destination.md | 2 +- ...ows_service_creation_on_remote_endpoint.md | 2 +- ...s_service_initiation_on_remote_endpoint.md | 2 +- ...ocess_instantiation_via_winrm_and_winrs.md | 2 +- ...sk_creation_on_remote_endpoint_using_at.md | 2 +- ...uled_task_initiation_on_remote_endpoint.md | 2 +- .../2021-11-11-wmic_xsl_execution_via_url.md | 4 +- ...2-aws_iam_accessdenied_discovery_events.md | 2 +- ...21-11-12-csc_net_on_the_fly_compilation.md | 2 +- ...1-11-12-firewall_allowed_program_enable.md | 2 +- ...twork_discovery_using_route_windows_app.md | 2 +- ...12-remote_process_instantiation_via_wmi.md | 4 +- ...21-11-12-runas_execution_in_commandline.md | 2 +- ...12-windows_installutil_uninstall_option.md | 2 +- ...windows_installutil_url_in_command_line.md | 2 +- ...s_instantiation_via_dcom_and_powershell.md | 2 +- ...ss_instantiation_via_wmi_and_powershell.md | 2 +- ...ion_via_wmi_and_powershell_script_block.md | 2 +- .../2021-11-15-windows_diskcryptor_usage.md | 2 +- ..._instantiation_via_winrm_and_powershell.md | 2 +- ...2021-11-17-windows_dism_remove_defender.md | 2 +- ...ile_written_in_administrative_smb_share.md | 2 +- ...info_gathering_using_dxdiag_application.md | 2 +- ...22-possible_browser_pass_view_parameter.md | 2 +- ...services_lolbas_execution_process_spawn.md | 2 +- ...-svchost_lolbas_execution_process_spawn.md | 2 +- ...ce_created_with_suspicious_service_path.md | 2 +- ...dows_service_created_within_public_path.md | 2 +- ...wmiprsve_lolbas_execution_process_spawn.md | 2 +- ...provhost_lolbas_execution_process_spawn.md | 2 +- ...1-23-mmc_lolbas_execution_process_spawn.md | 2 +- ...5-add_or_set_windows_defender_exclusion.md | 2 +- ...ell_windows_defender_exclusion_commands.md | 2 +- ...-11-29-detect_rclone_command-line_usage.md | 2 +- ...sible_lateral_movement_powershell_spawn.md | 2 +- ...-06-suspicious_linux_discovery_commands.md | 2 +- ...windows_raccine_scheduled_task_deletion.md | 2 +- ...-12-10-curl_download_and_bash_execution.md | 2 +- ...-12-11-wget_download_and_bash_execution.md | 2 +- .../2021-12-13-linux_java_spawning_shell.md | 2 +- ...load_injection_with_outbound_connection.md | 2 +- ...onnection_from_java_using_default_ports.md | 2 +- ...2021-12-13-windows_java_spawning_shells.md | 2 +- ..._add_files_in_known_crontab_directories.md | 2 +- ...-17-linux_at_allow_config_file_creation.md | 2 +- ...1-12-17-linux_edit_cron_table_parameter.md | 2 +- ..._cronjob_entry_on_existing_cronjob_file.md | 2 +- ...ssible_cronjob_modification_with_editor.md | 2 +- ...ux_file_creation_in_init_boot_directory.md | 2 +- ...inux_file_creation_in_profile_directory.md | 2 +- ...e_append_command_to_profile_config_file.md | 2 +- ...rvice_file_created_in_systemd_directory.md | 2 +- .../2021-12-20-linux_service_restarted.md | 2 +- ...-12-20-linux_service_started_or_enabled.md | 2 +- .../2021-12-21-linux_add_user_account.md | 2 +- ...1-12-21-linux_change_file_owner_to_root.md | 2 +- ...21-linux_nopasswd_entry_in_sudoers_file.md | 2 +- ...-12-21-linux_setuid_using_chmod_utility.md | 2 +- ...12-21-linux_setuid_using_setcap_utility.md | 2 +- ...21-12-21-linux_visudo_utility_execution.md | 2 +- ...file_created_in_kernel_driver_directory.md | 2 +- ...sert_kernel_module_using_insmod_utility.md | 2 +- ...ll_kernel_module_using_modprobe_utility.md | 2 +- ...2-22-linux_preload_hijack_library_calls.md | 2 +- ...ux_common_process_for_elevation_control.md | 2 +- ...1-12-23-linux_sudoers_tmp_file_creation.md | 2 +- .../2022-01-04-linux_sudo_or_su_execution.md | 2 +- ...022-01-05-linux_doas_conf_file_creation.md | 2 +- .../2022-01-05-linux_doas_tool_execution.md | 2 +- ...nux_possible_access_to_credential_files.md | 2 +- ...0-linux_possible_access_to_sudoers_file.md | 2 +- ...ess_or_modification_of_sshd_config_file.md | 2 +- ...11-linux_possible_ssh_key_file_creation.md | 2 +- ..._connect_to_internet_with_hidden_window.md | 2 +- ...tentially_malicious_code_on_commandline.md | 4 +- ...-cmd_carry_out_string_command_parameter.md | 2 +- ...lateral_movement_commandline_parameters.md | 2 +- ...us_powershell_process_-_encoded_command.md | 2 +- ...shell_remove_windows_defender_directory.md | 2 +- ...dows_dotnet_binary_in_non_standard_path.md | 4 +- ...indows_installutil_in_non_standard_path.md | 2 +- .../2022-01-20-ping_sleep_batch_command.md | 2 +- .../2022-01-21-windows_nirsoft_advancedrun.md | 2 +- .../2022-01-24-windows_nirsoft_utilities.md | 2 +- ...6-log4shell_cve-2021-44228_exploitation.md | 2 +- ...01-28-linux_pkexec_privilege_escalation.md | 2 +- ...tz_passtheticket_commandline_parameters.md | 2 +- ...22-02-01-rubeus_command_line_parameters.md | 2 +- ...nload_with_urlcache_and_split_arguments.md | 2 +- ...load_with_verifyctl_and_split_arguments.md | 2 +- ...2022-02-03-o365_added_service_principal.md | 2 +- ...22-02-03-o365_bypass_mfa_via_trusted_ip.md | 2 +- docs/_posts/2022-02-03-o365_disable_mfa.md | 2 +- ...dows_remote_assistance_spawning_process.md | 2 +- ...7-windows_schtasks_create_run_as_system.md | 2 +- ...022-02-08-rundll_loading_dll_by_ordinal.md | 4 +- ...oasting_spn_request_with_rc4_encryption.md | 2 +- .../2022-02-14-linux_dd_file_overwrite.md | 2 +- ...2-15-windows_diskshadow_proxy_execution.md | 4 +- ...22-02-15-windows_rasautou_dll_execution.md | 2 +- ...authentication_discovery_with_powerview.md | 2 +- .../2022-02-18-net_profiler_uac_bypass.md | 2 +- ...excessive_authentication_failures_alert.md | 2 +- ...cution_policy_to_unrestricted_or_bypass.md | 2 +- ...uthentication_discovery_with_get-aduser.md | 2 +- ...heduled_task_deleted_or_created_via_cmd.md | 2 +- ...2-02-22-windows_wmi_process_call_create.md | 4 +- ...ndows_excessive_disabled_services_event.md | 2 +- ...dows_process_with_namedpipe_commandline.md | 2 +- ...le_without_extension_in_critical_folder.md | 2 +- ...ve_distinct_processes_from_windows_temp.md | 2 +- docs/_posts/2022-03-03-aws_createaccesskey.md | 2 +- .../2022-03-03-aws_updateloginprofile.md | 2 +- docs/_posts/2022-03-04-macos_lolbin.md | 2 +- .../2022-03-08-suspicious_msbuild_path.md | 2 +- ...own_process_using_the_kerberos_protocol.md | 2 +- ...t_regasm_with_no_command_line_arguments.md | 2 +- ..._regsvcs_with_no_command_line_arguments.md | 2 +- ..._no_command_line_arguments_with_network.md | 2 +- ..._no_command_line_arguments_with_network.md | 2 +- ...ice_ticket_request_using_rc4_encryption.md | 2 +- ..._no_command_line_arguments_with_network.md | 4 +- ...lhost_with_no_command_line_with_network.md | 2 +- ...cious_dllhost_no_command_line_arguments.md | 4 +- ...ious_gpupdate_no_command_line_arguments.md | 2 +- ...ious_rundll32_no_command_line_arguments.md | 4 +- ...hprotocolhost_no_command_line_arguments.md | 2 +- ...s_installutil_remote_network_connection.md | 2 +- ...stallutil_uninstall_option_with_network.md | 2 +- ...odify_acl_permission_to_files_or_folder.md | 2 +- ...wordpolicy_with_powershell_script_block.md | 2 +- ...domainuser_with_powershell_script_block.md | 2 +- ...oup_discovery_with_script_block_logging.md | 2 +- ...getadgroup_with_powershell_script_block.md | 2 +- ...rrent_user_with_powershell_script_block.md | 2 +- ...tlocaluser_with_powershell_script_block.md | 2 +- ...sion_on_remote_endpoint_with_powershell.md | 2 +- ...ntication_flag_disabled_with_powershell.md | 2 +- ...022-03-22-powershell_execute_com_object.md | 2 +- ...owershell_using_memory_as_backing_store.md | 2 +- ...3-22-recon_avproduct_through_pwh_or_wmi.md | 2 +- ...on_via_dcom_and_powershell_script_block.md | 2 +- ...n_via_winrm_and_powershell_script_block.md | 2 +- ...y_with_env_vars_powershell_script_block.md | 2 +- ...uter_unconstrained_delegation_discovery.md | 2 +- ...view_unconstrained_delegation_discovery.md | 2 +- ...022-03-29-windows_iso_lnk_file_creation.md | 2 +- ...erview_constrained_delegation_discovery.md | 2 +- ...4-windows_driver_load_non-standard_path.md | 2 +- ...4-04-windows_event_for_service_disabled.md | 2 +- .../2022-04-05-java_writing_jsp_file.md | 2 +- ...nux_stdout_redirection_to_dev_null_file.md | 2 +- ...indirect_command_execution_via_forfiles.md | 2 +- ...s_indirect_command_execution_via_pcalua.md | 2 +- ..._spring4shell_http_request_class_module.md | 2 +- .../2022-04-07-any_powershell_downloadfile.md | 2 +- ...022-04-07-any_powershell_downloadstring.md | 2 +- .../2022-04-07-detect_html_help_renamed.md | 2 +- .../_posts/2022-04-07-detect_mshta_renamed.md | 2 +- .../2022-04-07-detect_renamed_psexec.md | 2 +- ...ious_microsoft_workflow_compiler_rename.md | 2 +- .../2022-04-07-suspicious_msbuild_rename.md | 2 +- .../2022-04-07-suspicious_rundll32_rename.md | 2 +- ...2-04-13-windows_registry_delete_task_sd.md | 2 +- ...022-04-18-nltest_domain_trust_discovery.md | 2 +- ...nux_adding_crontab_using_list_parameter.md | 2 +- ...ing_critical_directory_using_rm_command.md | 2 +- .../2022-04-22-linux_disable_services.md | 2 +- ...022-04-22-linux_shred_overwrite_command.md | 2 +- docs/_posts/2022-04-22-linux_stop_services.md | 2 +- ...ndows_linked_policies_in_adsi_discovery.md | 2 +- ...s_root_domain_linked_policies_discovery.md | 2 +- ...6-windows_hidden_schedule_task_settings.md | 2 +- ...ter_account_created_by_computer_account.md | 2 +- ...uter_account_requesting_kerberos_ticket.md | 2 +- ...windows_kerberos_local_successful_logon.md | 2 +- ...04-28-windows_computer_account_with_spn.md | 2 +- ...30-linux_iptables_firewall_modification.md | 2 +- ...worker_process_in_writable_process_path.md | 2 +- ...-02-windows_krbrelayup_service_creation.md | 2 +- ...ndows_service_create_kernel_mode_driver.md | 2 +- .../2022-05-16-windows_system_file_on_disk.md | 2 +- ...e_policy_version_to_allow_all_resources.md | 2 +- ...chtasks_scheduling_job_on_remote_system.md | 2 +- ...22-05-26-linux_at_application_execution.md | 2 +- ..._append_command_to_at_allow_config_file.md | 2 +- docs/_posts/2022-05-26-macos_plutil.md | 2 +- ...ripting_interpreter_path_traversal_exec.md | 170 +++++++++++++++ ...ws_execute_arbitrary_commands_with_msdt.md | 179 ++++++++++++++++ ...30-windows_office_product_spawning_msdt.md | 185 +++++++++++++++++ ...ostic_tool_vulnerability_cve-2022-30190.md | 50 +++++ docs/_stories/spearphishing_attachments.md | 1 + .../windows_defense_evasion_tactics.md | 1 + docs/mitre-map/coverage.json | 16 +- 596 files changed, 1540 insertions(+), 761 deletions(-) create mode 100644 docs/_posts/2022-05-30-windows_command_and_scripting_interpreter_path_traversal_exec.md create mode 100644 docs/_posts/2022-05-30-windows_execute_arbitrary_commands_with_msdt.md create mode 100644 docs/_posts/2022-05-30-windows_office_product_spawning_msdt.md create mode 100644 docs/_stories/microsoft_support_diagnostic_tool_vulnerability_cve-2022-30190.md diff --git a/dist/escu/app.manifest b/dist/escu/app.manifest index 47eedf168a..41536b0767 100644 --- a/dist/escu/app.manifest +++ b/dist/escu/app.manifest @@ -5,7 +5,7 @@ "id": { "group": null, "name": "DA-ESS-ContentUpdate", - "version": "3.40.0" + "version": "3.41.0" }, "author": [ { diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf index 7d0f06e3eb..a249152145 100644 --- a/dist/escu/default/analyticstories.conf +++ b/dist/escu/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-05-23T20:35:38 UTC +# On Date: 2022-05-31T17:59:08 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -4150,7 +4150,7 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies a suspicious process creation of At application. This process can be used by malware, adversaries and red teamers to create persistence entry to the targeted or compromised host with their malicious code. This anomaly detection can be a good indicator to investigate the event before and after this process execution, when it was executed and what schedule task it will execute. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. -annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.001", "T1053"], "nist": ["DE.CM"]} +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.002", "T1053"], "nist": ["DE.CM"]} known_false_positives = Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. providing_technologies = [] @@ -4430,7 +4430,7 @@ asset_type = Endpoint confidence = medium explanation = This analytic looks for suspicious commandline that may use to append user entry to /etc/at.allow or /etc/at.deny. These 2 files are commonly abused by malware, adversaries or red teamers to persist on the targeted or compromised host. These config file can restrict user that can only execute at application (another schedule task application in linux). attacker can create a user or add the compromised username to that config file to execute at to schedule it malicious code. This anomaly detection can be a good indicator to investigate further the entry in created config file and who created it to verify if it is a false positive. how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. -annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.001", "T1053"], "nist": ["DE.CM"]} +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.002", "T1053"], "nist": ["DE.CM"]} known_false_positives = Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives. providing_technologies = [] @@ -4660,7 +4660,7 @@ asset_type = Endpoint confidence = medium explanation = Detect usage of plutil to modify plist files. Adversaries can modiy plist files to executed binaries or add command line arguments. Plist files in auto-run locations are executed upon user logon or system startup. how_to_implement = This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. -annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.011"], "nist": ["DE.CM"]} +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1647"], "nist": ["DE.CM"]} known_false_positives = Administrators using plutil to change plist files. providing_technologies = [] @@ -6976,6 +6976,16 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre known_false_positives = administrators rarely use adfind, usually not used for legitimate reasons providing_technologies = [] +[savedsearch://ESCU - Windows Command and Scripting Interpreter Path Traversal Exec - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies path traversal commandline execution. This technique was seen in malicious document that execute malicious code using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and commandline that runs before and after this execution. This may help you to find possible downloaded malware or other lolbin execution. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]} +known_false_positives = Not known at this moment. +providing_technologies = [] + [savedsearch://ESCU - Windows Computer Account Created by Computer Account - Rule] type = detection asset_type = Endpoint @@ -7235,6 +7245,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp known_false_positives = Unknown providing_technologies = [] +[savedsearch://ESCU - Windows Execute Arbitrary Commands with MSDT - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies a recently disclosed arbitraty command execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve a remote payload. During triage, review file modifications for html. Identify parallel process execution that may be related, including an Office Product. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1202"], "nist": ["DE.CM"]} +known_false_positives = False positives may be present, filter as needed. +providing_technologies = [] + [savedsearch://ESCU - Windows File Without Extension In Critical Folder - Rule] type = detection asset_type = Endpoint @@ -7485,6 +7505,16 @@ annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": [ known_false_positives = False positives will occur based on legitimate application requests, filter based on source image as needed. providing_technologies = [] +[savedsearch://ESCU - Windows Office Product Spawning MSDT - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies a Microsoft Office product spawning the Windows msdt.exe process. MSDT is a Diagnostics Troubleshooting Wizard native to Windows. This behavior is related to a recently identified sample utilizing protocol handlers to evade preventative controls, including if macros are disabled in the document. During triage, review file modifications for html. In addition, parallel processes including PowerShell and CertUtil. +how_to_implement = how To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.CM"]} +known_false_positives = False positives should be limited, however filter as needed. +providing_technologies = [] + [savedsearch://ESCU - Windows Possible Credential Dumping - Rule] type = detection asset_type = Endpoint @@ -10089,6 +10119,17 @@ description = CVE-2021-40444 is a remote code execution vulnerability in MSHTML, narrative = Microsoft is aware of targeted attacks that attempt to exploit this vulnerability, CVE-2021-40444 by using specially-crafted Microsoft Office documents. MSHTML is a software component used to render web pages on Windows. Although it is 2019s most commonly associated with Internet Explorer, it is also used in other software. CVE-2021-40444 received a CVSS score of 8.8 out of 10. MSHTML is the beating heart of Internet Explorer, the vulnerability also exists in that browser. Although given its limited use, there is little risk of infection by that vector. Microsoft Office applications use the MSHTML component to display web content in Office documents. The attack depends on MSHTML loading a specially crafted ActiveX control when the target opens a malicious Office document. The loaded ActiveX control can then run arbitrary code to infect the system with more malware. At the moment all supported Windows versions are vulnerable. Since there is no patch available yet, Microsoft proposes a few methods to block these attacks. \ 1. Disable the installation of all ActiveX controls in Internet Explorer via the registry. Previously-installed ActiveX controls will still run, but no new ones will be added, including malicious ones. Open documents from the Internet in Protected View or Application Guard for Office, both of which prevent the current attack. This is a default setting but it may have been changed. +[analytic_story://Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190] +category = Adversary Tactics +last_updated = 2022-05-31 +version = 1 +references = ["https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/", "https://isc.sans.edu/diary/rss/28694", "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e", "https://twitter.com/nao_sec/status/1530196847679401984?s=20\u0026t=ZiXYI4dQuA-0_dzQzSUb3A", "https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/", "https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection", "https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html"] +maintainers = [{"company": "Teoderick Contreras, Splunk", "email": "-", "name": "Michael Haag"}] +spec_version = 3 +searches = ["ESCU - Windows Command and Scripting Interpreter Path Traversal Exec - Rule", "ESCU - Windows Execute Arbitrary Commands with MSDT - Rule", "ESCU - Windows Office Product Spawning MSDT - Rule"] +description = On Monday May 30, 2022, Microsoft issued CVE-2022-30190 regarding the Microsoft Support Diagnostic Tool (MSDT) in Windows vulnerability. +narrative = A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user''s rights. + [analytic_story://Monitor for Updates] category = Best Practices last_updated = 2017-09-15 @@ -10397,7 +10438,7 @@ version = 1 references = ["https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Splunk Research Team"}] spec_version = 3 -searches = ["ESCU - Excel Spawning PowerShell - Rule", "ESCU - Excel Spawning Windows Script Host - Rule", "ESCU - MSHTML Module Load in Office Product - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Creating Schedule Task - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Document Spawned Child Process To Download - Rule", "ESCU - Office Product Spawning BITSAdmin - Rule", "ESCU - Office Product Spawning CertUtil - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Office Product Spawning Rundll32 with no DLL - Rule", "ESCU - Office Product Spawning Wmic - Rule", "ESCU - Office Product Writing cab or inf - Rule", "ESCU - Office Spawning Control - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Windows ISO LNK File Creation - Rule", "ESCU - Winword Spawning Cmd - Rule", "ESCU - Winword Spawning PowerShell - Rule", "ESCU - Gdrive suspicious file sharing - Rule", "ESCU - Gsuite suspicious calendar invite - Rule", "ESCU - Detect Outlook exe writing a zip file - Rule"] +searches = ["ESCU - Excel Spawning PowerShell - Rule", "ESCU - Excel Spawning Windows Script Host - Rule", "ESCU - MSHTML Module Load in Office Product - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Creating Schedule Task - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Document Spawned Child Process To Download - Rule", "ESCU - Office Product Spawning BITSAdmin - Rule", "ESCU - Office Product Spawning CertUtil - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Office Product Spawning Rundll32 with no DLL - Rule", "ESCU - Office Product Spawning Wmic - Rule", "ESCU - Office Product Writing cab or inf - Rule", "ESCU - Office Spawning Control - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Windows ISO LNK File Creation - Rule", "ESCU - Windows Office Product Spawning MSDT - Rule", "ESCU - Winword Spawning Cmd - Rule", "ESCU - Winword Spawning PowerShell - Rule", "ESCU - Gdrive suspicious file sharing - Rule", "ESCU - Gsuite suspicious calendar invite - Rule", "ESCU - Detect Outlook exe writing a zip file - Rule"] description = Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack. narrative = Despite its simplicity, phishing remains the most pervasive and dangerous cyberthreat. In fact, research shows that as many as [91% of all successful attacks](https://digitalguardian.com/blog/91-percent-cyber-attacks-start-phishing-email-heres-how-protect-against-phishing) are initiated via a phishing email. \ As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Worse, because its success relies on the gullibility of humans, it's impossible to completely "automate" it out of your environment. However, you can use ES and ESCU to detect and investigate potentially malicious payloads injected into your environment subsequent to a phishing attack. \ @@ -10800,7 +10841,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Defense_Evasion"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Add or Set Windows Defender Exclusion - Rule", "ESCU - CSC Net On The Fly Compilation - Rule", "ESCU - Disable Registry Tool - Rule", "ESCU - Disable Security Logs Using MiniNt Registry - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - Firewall Allowed Program Enable - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Powershell Windows Defender Exclusion Commands - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - Windows Defender Exclusion Registry Entry - Rule", "ESCU - Windows Disable Change Password Through Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable Notification Center - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows DISM Remove Defender - Rule", "ESCU - Windows Event For Service Disabled - Rule", "ESCU - Windows Excessive Disabled Services Event - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule", "ESCU - Windows Process With NamedPipe CommandLine - Rule", "ESCU - Windows Rasautou DLL Execution - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Add or Set Windows Defender Exclusion - Rule", "ESCU - CSC Net On The Fly Compilation - Rule", "ESCU - Disable Registry Tool - Rule", "ESCU - Disable Security Logs Using MiniNt Registry - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - Firewall Allowed Program Enable - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Powershell Windows Defender Exclusion Commands - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - Windows Command and Scripting Interpreter Path Traversal Exec - Rule", "ESCU - Windows Defender Exclusion Registry Entry - Rule", "ESCU - Windows Disable Change Password Through Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable Notification Center - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows DISM Remove Defender - Rule", "ESCU - Windows Event For Service Disabled - Rule", "ESCU - Windows Excessive Disabled Services Event - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule", "ESCU - Windows Process With NamedPipe CommandLine - Rule", "ESCU - Windows Rasautou DLL Execution - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms. @@ -10827,7 +10868,7 @@ description = Uncover activity consistent with CVE-2020-1350, or SIGRed. Discove narrative = When a client requests a DNS record for a particular domain, that request gets routed first through the client's locally configured DNS server, then to any DNS server(s) configured as forwarders, and then onto the target domain's own DNS server(s). If a attacker wanted to, they could host a malicious DNS server that responds to the initial request with a specially crafted large response (~65KB). This response would flow through to the client's local DNS server, which if not patched for CVE-2020-1350, would cause the buffer overflow. The detection searches in this Analytic Story use wire data to detect the malicious behavior. Searches for Splunk Stream and Zeek are included. The Splunk Stream search correlates across stream:dns and stream:tcp, while the Zeek search correlates across bro:dns:json and bro:conn:json. These correlations are required to pick up both the DNS record types (SIG and KEY) along with the payload size (>65KB). [analytic_story://Windows Drivers] -category = +category = Adversary Tactics last_updated = 2022-03-30 version = 1 references = ["https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/", "https://www.trendmicro.com/en_us/research/22/e/avoslocker-ransomware-variant-abuses-driver-file-to-disable-anti-Virus-scans-log4shell.html", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage", "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf", "https://www.welivesecurity.com/2022/01/11/signed-kernel-drivers-unguarded-gateway-windows-core/"] diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf index fadb5d2577..cb04e698c1 100644 --- a/dist/escu/default/app.conf +++ b/dist/escu/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 7910 +build = 8031 [triggers] reload.analytic_stories = simple @@ -20,7 +20,7 @@ reload.es_investigations = simple [launcher] author = Splunk -version = 3.40.0 +version = 3.41.0 description = Explore the Analytic Stories included with ES Content Updates. [ui] diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index cbb5615110..bb31722eed 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-05-23T20:35:38 UTC +# On Date: 2022-05-31T17:59:08 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/content-version.conf b/dist/escu/default/content-version.conf index 911f6436e0..0ad1a936ff 100644 --- a/dist/escu/default/content-version.conf +++ b/dist/escu/default/content-version.conf @@ -1,2 +1,2 @@ [content-version] -version = 3.40.0 +version = 3.41.0 diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf index 69bf9867ea..5f17437416 100644 --- a/dist/escu/default/es_investigations.conf +++ b/dist/escu/default/es_investigations.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-05-23T20:35:38 UTC +# On Date: 2022-05-31T17:59:08 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 8df7cc6e42..86135c0ec1 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-05-23T20:35:38 UTC +# On Date: 2022-05-31T17:59:08 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -2733,6 +2733,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[windows_command_and_scripting_interpreter_path_traversal_exec_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [windows_computer_account_created_by_computer_account_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2833,6 +2837,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[windows_execute_arbitrary_commands_with_msdt_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [windows_file_without_extension_in_critical_folder_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2925,6 +2933,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[windows_office_product_spawning_msdt_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [windows_possible_credential_dumping_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index a67d6e7a91..2eba44ba3a 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-05-23T20:35:38 UTC +# On Date: 2022-05-31T17:59:08 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -17782,13 +17782,13 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies a suspicious process creation of At application. This process can be used by malware, adversaries and red teamers to create persistence entry to the targeted or compromised host with their malicious code. This anomaly detection can be a good indicator to investigate the event before and after this process execution, when it was executed and what schedule task it will execute. -action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.001", "T1053"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.002", "T1053"], "nist": ["DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies a suspicious process creation of At application. This process can be used by malware, adversaries and red teamers to create persistence entry to the targeted or compromised host with their malicious code. This anomaly detection can be a good indicator to investigate the event before and after this process execution, when it was executed and what schedule task it will execute. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. action.escu.known_false_positives = Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. -action.escu.creation_date = 2021-12-17 -action.escu.modification_date = 2021-12-17 +action.escu.creation_date = 2022-05-26 +action.escu.modification_date = 2022-05-26 action.escu.confidence = high action.escu.full_search_name = ESCU - Linux At Application Execution - Rule action.escu.search_type = detection @@ -17805,7 +17805,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Linux At Application Execution - Rule -action.correlationsearch.annotations = {"analytic_story": ["Linux Privilege Escalation", "Linux Persistence Techniques"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Persistence"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.001", "T1053"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Linux Privilege Escalation", "Linux Persistence Techniques"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Persistence"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.002", "T1053"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -18950,13 +18950,13 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime action.escu = 0 action.escu.enabled = 1 description = This analytic looks for suspicious commandline that may use to append user entry to /etc/at.allow or /etc/at.deny. These 2 files are commonly abused by malware, adversaries or red teamers to persist on the targeted or compromised host. These config file can restrict user that can only execute at application (another schedule task application in linux). attacker can create a user or add the compromised username to that config file to execute at to schedule it malicious code. This anomaly detection can be a good indicator to investigate further the entry in created config file and who created it to verify if it is a false positive. -action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.001", "T1053"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.002", "T1053"], "nist": ["DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic looks for suspicious commandline that may use to append user entry to /etc/at.allow or /etc/at.deny. These 2 files are commonly abused by malware, adversaries or red teamers to persist on the targeted or compromised host. These config file can restrict user that can only execute at application (another schedule task application in linux). attacker can create a user or add the compromised username to that config file to execute at to schedule it malicious code. This anomaly detection can be a good indicator to investigate further the entry in created config file and who created it to verify if it is a false positive. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. action.escu.known_false_positives = Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives. -action.escu.creation_date = 2021-12-17 -action.escu.modification_date = 2021-12-17 +action.escu.creation_date = 2022-05-26 +action.escu.modification_date = 2022-05-26 action.escu.confidence = high action.escu.full_search_name = ESCU - Linux Possible Append Command To At Allow Config File - Rule action.escu.search_type = detection @@ -18973,7 +18973,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Linux Possible Append Command To At Allow Config File - Rule -action.correlationsearch.annotations = {"analytic_story": ["Linux Privilege Escalation", "Linux Persistence Techniques"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Persistence"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.001", "T1053"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Linux Privilege Escalation", "Linux Persistence Techniques"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Persistence"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.002", "T1053"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -19912,13 +19912,13 @@ search = `osquery` name=es_process_events columns.cmdline IN ("find*", "crontab* action.escu = 0 action.escu.enabled = 1 description = Detect usage of plutil to modify plist files. Adversaries can modiy plist files to executed binaries or add command line arguments. Plist files in auto-run locations are executed upon user logon or system startup. -action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.011"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1647"], "nist": ["DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = Detect usage of plutil to modify plist files. Adversaries can modiy plist files to executed binaries or add command line arguments. Plist files in auto-run locations are executed upon user logon or system startup. action.escu.how_to_implement = This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. action.escu.known_false_positives = Administrators using plutil to change plist files. -action.escu.creation_date = 2022-03-29 -action.escu.modification_date = 2022-03-29 +action.escu.creation_date = 2022-05-26 +action.escu.modification_date = 2022-05-26 action.escu.confidence = high action.escu.full_search_name = ESCU - MacOS plutil - Rule action.escu.search_type = detection @@ -19935,7 +19935,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - MacOS plutil - Rule -action.correlationsearch.annotations = {"analytic_story": ["Living Off The Land"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.011"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Living Off The Land"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1647"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = user,dest @@ -30182,6 +30182,52 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="* -f *" OR Processes.process="* -b *") AND (Processes.process=*objectcategory* OR Processes.process="* -gcb *" OR Processes.process="* -sc *") by Processes.dest Processes.user Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_adfind_exe_filter` +[ESCU - Windows Command and Scripting Interpreter Path Traversal Exec - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies path traversal commandline execution. This technique was seen in malicious document that execute malicious code using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and commandline that runs before and after this execution. This may help you to find possible downloaded malware or other lolbin execution. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies path traversal commandline execution. This technique was seen in malicious document that execute malicious code using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and commandline that runs before and after this execution. This may help you to find possible downloaded malware or other lolbin execution. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product +action.escu.known_false_positives = Not known at this moment. +action.escu.creation_date = 2022-05-30 +action.escu.modification_date = 2022-05-30 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Windows Command and Scripting Interpreter Path Traversal Exec - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190"] +action.risk = 1 +action.risk.param._risk_message = A parent process $parent_process_name$ has spawned a child $process_name$ with path traversal commandline $process$ in $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Windows Command and Scripting Interpreter Path Traversal Exec - Rule +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = user,dest +action.notable.param.rule_description = The following analytic identifies path traversal commandline execution. This technique was seen in malicious document that execute malicious code using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and commandline that runs before and after this execution. This may help you to find possible downloaded malware or other lolbin execution. +action.notable.param.rule_title = Windows Command and Scripting Interpreter Path Traversal Exec +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*\/..\/..\/..\/..\/..\/..\/..\/..\/..\/*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_command_and_scripting_interpreter_path_traversal_exec_filter` + [ESCU - Windows Computer Account Created by Computer Account - Rule] action.escu = 0 action.escu.enabled = 1 @@ -31290,6 +31336,52 @@ realtime_schedule = 0 is_visible = false search = `wineventlog_system` EventCode=7040 Message = "*service was changed from demand start to disabled." | stats count values(Message) as MessageList dc(Message) as MessageCount min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode User Sid | where MessageCount >=10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_excessive_disabled_services_event_filter` +[ESCU - Windows Execute Arbitrary Commands with MSDT - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies a recently disclosed arbitraty command execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve a remote payload. During triage, review file modifications for html. Identify parallel process execution that may be related, including an Office Product. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1202"], "nist": ["DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies a recently disclosed arbitraty command execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve a remote payload. During triage, review file modifications for html. Identify parallel process execution that may be related, including an Office Product. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +action.escu.known_false_positives = False positives may be present, filter as needed. +action.escu.creation_date = 2022-05-30 +action.escu.modification_date = 2022-05-30 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Windows Execute Arbitrary Commands with MSDT - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190"] +action.risk = 1 +action.risk.param._risk_message = A parent process $parent_process_name$ has spawned a child process $process_name$ on host $dest$ possibly indicative of indirect command execution. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 100}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 100}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Windows Execute Arbitrary Commands with MSDT - Rule +action.correlationsearch.annotations = {"analytic_story": ["Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2022-30190"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1202"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = user,dest +action.notable.param.rule_description = The following analytic identifies a recently disclosed arbitraty command execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve a remote payload. During triage, review file modifications for html. Identify parallel process execution that may be related, including an Office Product. +action.notable.param.rule_title = Windows Execute Arbitrary Commands with MSDT +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msdt.exe Processes.process="*ms-msdt:/id*" Processes.process="*IT_BrowseForFile=*" Processes.process="*IT_RebrowseForFile=*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_execute_arbitrary_commands_with_msdt_filter` + [ESCU - Windows File Without Extension In Critical Folder - Rule] action.escu = 0 action.escu.enabled = 1 @@ -32363,6 +32455,52 @@ realtime_schedule = 0 is_visible = false search = `sysmon` EventCode=10 TargetImage=*lsass.exe SourceUser!="NT AUTHORITY\\*" | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_non_system_account_targeting_lsass_filter` +[ESCU - Windows Office Product Spawning MSDT - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies a Microsoft Office product spawning the Windows msdt.exe process. MSDT is a Diagnostics Troubleshooting Wizard native to Windows. This behavior is related to a recently identified sample utilizing protocol handlers to evade preventative controls, including if macros are disabled in the document. During triage, review file modifications for html. In addition, parallel processes including PowerShell and CertUtil. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies a Microsoft Office product spawning the Windows msdt.exe process. MSDT is a Diagnostics Troubleshooting Wizard native to Windows. This behavior is related to a recently identified sample utilizing protocol handlers to evade preventative controls, including if macros are disabled in the document. During triage, review file modifications for html. In addition, parallel processes including PowerShell and CertUtil. +action.escu.how_to_implement = how To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +action.escu.known_false_positives = False positives should be limited, however filter as needed. +action.escu.creation_date = 2022-05-30 +action.escu.modification_date = 2022-05-30 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Windows Office Product Spawning MSDT - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Spearphishing Attachments", "Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190"] +action.risk = 1 +action.risk.param._risk_message = Office parent process $parent_process_name$ has spawned a child process $process_name$ on host $dest$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 100}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 100}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Windows Office Product Spawning MSDT - Rule +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2022-30190"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = user,dest +action.notable.param.rule_description = The following analytic identifies a Microsoft Office product spawning the Windows msdt.exe process. MSDT is a Diagnostics Troubleshooting Wizard native to Windows. This behavior is related to a recently identified sample utilizing protocol handlers to evade preventative controls, including if macros are disabled in the document. During triage, review file modifications for html. In addition, parallel processes including PowerShell and CertUtil. +action.notable.param.rule_title = Windows Office Product Spawning MSDT +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","outlook.exe","mspub.exe","visio.exe") Processes.process_name=msdt.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_office_product_spawning_msdt_filter` + [ESCU - Windows Possible Credential Dumping - Rule] action.escu = 0 action.escu.enabled = 1 diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index e1853ebef6..1043809aaa 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-05-23T20:35:38 UTC +# On Date: 2022-05-31T17:59:08 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/workflow_actions.conf b/dist/escu/default/workflow_actions.conf index 9157f0f4c6..ba37b52846 100644 --- a/dist/escu/default/workflow_actions.conf +++ b/dist/escu/default/workflow_actions.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-05-23T20:35:38 UTC +# On Date: 2022-05-31T17:59:08 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/lookups/mitre_enrichment.csv b/dist/escu/lookups/mitre_enrichment.csv index 98e157fb74..3323f2a9f2 100644 --- a/dist/escu/lookups/mitre_enrichment.csv +++ b/dist/escu/lookups/mitre_enrichment.csv @@ -139,7 +139,7 @@ T1584.002,DNS Server,Resource Development,no T1584.001,Domains,Resource Development,Kimsuky|Lazarus Group|Transparent Tribe|Magic Hound|APT29|APT1 T1583.006,Web Services,Resource Development,APT28|Confucius|LazyScripter|Kimsuky|Magic Hound|IndigoZebra|ZIRCONIUM|MuddyWater|HAFNIUM|Lazarus Group|Turla|APT32|APT17|APT29 T1583.005,Botnet,Resource Development,no -T1583.004,Server,Resource Development,Kimsuky|Lazarus Group|Gelsemium|GALLIUM|Sandworm Team +T1583.004,Server,Resource Development,Kimsuky|Lazarus Group|GALLIUM|Sandworm Team T1583.003,Virtual Private Server,Resource Development,Axiom|Dragonfly|HAFNIUM|TEMP.Veles T1583.002,DNS Server,Resource Development,Axiom T1584,Compromise Infrastructure,Resource Development,no @@ -174,9 +174,9 @@ T1546.015,Component Object Model Hijacking,Privilege Escalation|Persistence,APT2 T1071.004,DNS,Command And Control,LazyScripter|Chimera|APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7 T1071.003,Mail Protocols,Command And Control,Turla|Kimsuky|APT32|SilverTerrier|APT28 T1071.002,File Transfer Protocols,Command And Control,Kimsuky|APT41|SilverTerrier|Honeybee -T1071.001,Web Protocols,Command And Control,Kimsuky|Confucius|TeamTNT|FIN8|APT29|Mustang Panda|Windshift|TA551|Higaisa|HAFNIUM|Sidewinder|Chimera|Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Rancor|Ke3chang|Orangeworm|APT37|APT19|Cobalt Group|Threat Group-3390|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|Magic Hound|APT32|OilRig|Gamaredon Group|Stealth Falcon +T1071.001,Web Protocols,Command And Control,Kimsuky|Confucius|TeamTNT|FIN8|APT29|Mustang Panda|Windshift|TA551|Higaisa|HAFNIUM|Sidewinder|Chimera|Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Dark Caracal|Cobalt Group|Orangeworm|Rancor|Threat Group-3390|Turla|APT19|APT37|Ke3chang|Lazarus Group|BRONZE BUTLER|Magic Hound|OilRig|APT32|Gamaredon Group|Stealth Falcon T1572,Protocol Tunneling,Command And Control,Leviathan|CostaRicto|Chimera|Fox Kitten|OilRig|Cobalt Group|FIN6 -T1048.003,Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol,Exfiltration,Wizard Spider|FIN6|APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group +T1048.003,Exfiltration Over Unencrypted Non-C2 Protocol,Exfiltration,Wizard Spider|FIN6|APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,APT28|APT29 T1048.001,Exfiltration Over Symmetric Encrypted Non-C2 Protocol,Exfiltration,no T1001.003,Protocol Impersonation,Command And Control,Higaisa|Lazarus Group @@ -189,18 +189,18 @@ T1090.003,Multi-hop Proxy,Command And Control,Leviathan|CostaRicto|APT28|Operati T1090.002,External Proxy,Command And Control,Tonto Team|APT39|Silence|GALLIUM|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28 T1090.001,Internal Proxy,Command And Control,Lazarus Group|Turla|APT29|Higaisa|Operation Wocao|APT39|Strider T1102.003,One-Way Communication,Command And Control,Leviathan -T1102.002,Bidirectional Communication,Command And Control,Kimsuky|Lazarus Group|ZIRCONIUM|MuddyWater|APT28|APT29|Sandworm Team|APT39|APT12|Turla|FIN7|APT37|Magic Hound|Carbanak +T1102.002,Bidirectional Communication,Command And Control,Kimsuky|Lazarus Group|ZIRCONIUM|MuddyWater|APT28|APT29|Sandworm Team|APT39|APT12|FIN7|Turla|APT37|Magic Hound|Carbanak T1102.001,Dead Drop Resolver,Command And Control,Rocke|APT41|BRONZE BUTLER|RTM|Patchwork T1571,Non-Standard Port,Command And Control,WIRTE|Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7 T1074.002,Remote Data Staging,Collection,Leviathan|APT28|APT29|Chimera|Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8 -T1074.001,Local Data Staging,Collection,Dragonfly|Indrik Spider|BackdoorDiplomacy|Mustang Panda|Sidewinder|Chimera|Kimsuky|APT39|Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|Honeybee|Dragonfly 2.0|Leviathan|APT3|FIN5|menuPass|Lazarus Group|Threat Group-3390|APT28 +T1074.001,Local Data Staging,Collection,Dragonfly|Indrik Spider|BackdoorDiplomacy|Mustang Panda|Sidewinder|Chimera|Kimsuky|APT39|Operation Wocao|GALLIUM|TEMP.Veles|Honeybee|Patchwork|Leviathan|APT3|FIN5|menuPass|Lazarus Group|Threat Group-3390|APT28 T1078.004,Cloud Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Ke3chang|APT29|APT28|APT33 T1564.004,NTFS File Attributes,Defense Evasion,APT32 T1564.003,Hidden Window,Defense Evasion,Gamaredon Group|Kimsuky|Nomadic Octopus|Higaisa|Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT29|Kimsuky|HAFNIUM|Turla|Operation Wocao|PROMETHIUM|Tropic Trooper|FIN10|APT32 T1078.002,Domain Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Naikon|Indrik Spider|Chimera|Operation Wocao|Sandworm Team|Wizard Spider|APT29|TA505|APT3|Threat Group-1314 T1078.001,Default Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,no -T1564.002,Hidden Users,Defense Evasion,Kimsuky|Dragonfly|Dragonfly 2.0 +T1564.002,Hidden Users,Defense Evasion,Kimsuky|Dragonfly T1574.006,Dynamic Linker Hijacking,Persistence|Privilege Escalation|Defense Evasion,APT41|Rocke T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,Lazarus Group|Mustang Panda|Higaisa|BlackTech|Sidewinder|Chimera|BRONZE BUTLER|Naikon|APT41|GALLIUM|Tropic Trooper|APT19|Patchwork|APT32|APT3|menuPass|Threat Group-3390 T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,Aquatic Panda|BackdoorDiplomacy|Tonto Team|Evilnum|APT41|Whitefly|RTM|Threat Group-3390|menuPass @@ -214,10 +214,10 @@ T1574,Hijack Execution Flow,Persistence|Privilege Escalation|Defense Evasion,no T1069.001,Local Groups,Discovery,Tonto Team|Chimera|Operation Wocao|Turla|OilRig|admin@338 T1570,Lateral Tool Transfer,Lateral Movement,Sandworm Team|Chimera|GALLIUM|Operation Wocao|APT32|Wizard Spider|Turla|FIN10 T1568.003,DNS Calculation,Command And Control,APT12 -T1204.002,Malicious File,Execution,LazyScripter|WIRTE|Confucius|Dragonfly|Threat Group-3390|Nomadic Octopus|Indrik Spider|APT38|Andariel|Ferocious Kitten|IndigoZebra|Transparent Tribe|Tonto Team|Magic Hound|Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|Kimsuky|FIN6|PROMETHIUM|APT30|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Dragonfly 2.0|FIN7|BRONZE BUTLER|Gorgon Group|OilRig|Dark Caracal|Cobalt Group|DarkHydrus|Rancor|Patchwork|APT32|APT19|MuddyWater|Lazarus Group|menuPass|APT37|Leviathan|TA459|APT29|APT28|FIN8|PLATINUM|Elderwood -T1204.001,Malicious Link,Execution,LazyScripter|Kimsuky|Lazarus Group|Confucius|FIN7|Transparent Tribe|APT3|Magic Hound|APT28|APT29|Mustang Panda|Sidewinder|ZIRCONIUM|MuddyWater|Evilnum|Sandworm Team|Wizard Spider|Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|Turla|APT33 +T1204.002,Malicious File,Execution,LazyScripter|WIRTE|Confucius|Dragonfly|Threat Group-3390|Nomadic Octopus|Indrik Spider|APT38|Andariel|Ferocious Kitten|IndigoZebra|Transparent Tribe|Tonto Team|Magic Hound|Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|Kimsuky|FIN6|PROMETHIUM|APT30|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Patchwork|Lazarus Group|MuddyWater|Rancor|Gorgon Group|OilRig|FIN7|APT32|BRONZE BUTLER|Cobalt Group|APT19|DarkHydrus|Dark Caracal|PLATINUM|menuPass|Leviathan|APT28|APT29|TA459|APT37|Elderwood|FIN8 +T1204.001,Malicious Link,Execution,LazyScripter|Kimsuky|Lazarus Group|Confucius|FIN7|Transparent Tribe|APT3|Magic Hound|APT28|APT29|Mustang Panda|Sidewinder|ZIRCONIUM|MuddyWater|Evilnum|Sandworm Team|Wizard Spider|Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Cobalt Group|APT39|Night Dragon|APT33|Turla T1195.003,Compromise Hardware Supply Chain,Initial Access,no -T1195.002,Compromise Software Supply Chain,Initial Access,Gelsemium|Threat Group-3390|APT29|Cobalt Group|GOLD SOUTHFIELD|Dragonfly|Sandworm Team|APT41 +T1195.002,Compromise Software Supply Chain,Initial Access,Threat Group-3390|APT29|Cobalt Group|GOLD SOUTHFIELD|Dragonfly|Sandworm Team|APT41 T1195.001,Compromise Software Dependencies and Development Tools,Initial Access,no T1568.001,Fast Flux DNS,Command And Control,menuPass|TA505 T1052.001,Exfiltration over USB,Exfiltration,Mustang Panda|Tropic Trooper @@ -225,16 +225,16 @@ T1569.002,Service Execution,Execution,APT38|Chimera|Operation Wocao|Wizard Spide T1569.001,Launchctl,Execution,no T1569,System Services,Execution,no T1568.002,Domain Generation Algorithms,Command And Control,TA551|APT41 -T1568,Dynamic Resolution,Command And Control,Gamaredon Group|Gelsemium|Transparent Tribe|APT29 +T1568,Dynamic Resolution,Command And Control,Gamaredon Group|Transparent Tribe|APT29 T1011.001,Exfiltration Over Bluetooth,Exfiltration,no T1567.002,Exfiltration to Cloud Storage,Exfiltration,Kimsuky|Threat Group-3390|Confucius|Lazarus Group|FIN7|ZIRCONIUM|HAFNIUM|Chimera|Leviathan|Turla T1567.001,Exfiltration to Code Repository,Exfiltration,no -T1059.006,Python,Execution,Dragonfly|Tonto Team|APT37|ZIRCONIUM|MuddyWater|Turla|Operation Wocao|Kimsuky|APT29|Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete -T1059.005,Visual Basic,Execution,Confucius|Lazarus Group|LazyScripter|OilRig|APT38|Transparent Tribe|APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|APT39|Machete|Operation Wocao|Kimsuky|APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound +T1059.006,Python,Execution,Dragonfly|Tonto Team|APT37|ZIRCONIUM|MuddyWater|Turla|Operation Wocao|Kimsuky|APT29|Rocke|BRONZE BUTLER|APT39|Machete +T1059.005,Visual Basic,Execution,Confucius|Lazarus Group|LazyScripter|OilRig|APT38|Transparent Tribe|APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|APT39|Machete|Operation Wocao|Kimsuky|APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Gorgon Group|Cobalt Group|Leviathan|TA459|Magic Hound T1059.004,Unix Shell,Execution,TeamTNT|Rocke|APT41 -T1059.003,Windows Command Shell,Execution,Kimsuky|Aquatic Panda|Dragonfly|LazyScripter|Sandworm Team|Nomadic Octopus|TeamTNT|APT29|Mustang Panda|ZIRCONIUM|TA551|Higaisa|Indrik Spider|Chimera|Fox Kitten|Machete|Operation Wocao|Wizard Spider|FIN6|TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|GALLIUM|Turla|Silence|APT32|Darkhotel|MuddyWater|APT18|APT38|Gorgon Group|Dark Caracal|Ke3chang|Dragonfly 2.0|Rancor|FIN8|APT28|APT37|Magic Hound|BRONZE BUTLER|Sowbug|menuPass|FIN10|Threat Group-3390|Gamaredon Group|Patchwork|Suckfly|Threat Group-1314|APT3|admin@338|APT1 +T1059.003,Windows Command Shell,Execution,Kimsuky|Aquatic Panda|Dragonfly|LazyScripter|Sandworm Team|Nomadic Octopus|TeamTNT|APT29|Mustang Panda|ZIRCONIUM|TA551|Higaisa|Indrik Spider|Chimera|Fox Kitten|Machete|Operation Wocao|Wizard Spider|FIN6|TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|GALLIUM|Turla|Silence|APT32|Darkhotel|MuddyWater|APT18|APT38|Dark Caracal|Ke3chang|Gorgon Group|Rancor|FIN8|APT28|APT37|Magic Hound|BRONZE BUTLER|Sowbug|menuPass|FIN10|Threat Group-3390|Gamaredon Group|Suckfly|Patchwork|Threat Group-1314|APT3|admin@338|APT1 T1059.002,AppleScript,Execution,no -T1059.001,PowerShell,Execution,Gamaredon Group|Lazarus Group|Aquatic Panda|Confucius|Dragonfly|LazyScripter|Nomadic Octopus|TeamTNT|APT38|Tonto Team|Mustang Panda|Indrik Spider|HAFNIUM|Sidewinder|Fox Kitten|GOLD SOUTHFIELD|Sandworm Team|Operation Wocao|Chimera|Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|GALLIUM|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|Thrip|Cobalt Group|APT28|DarkHydrus|Dragonfly 2.0|APT19|Gorgon Group|TA459|Leviathan|MuddyWater|FIN8|CopyKittens|OilRig|Magic Hound|BRONZE BUTLER|FIN7|APT32|menuPass|FIN10|Threat Group-3390|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda +T1059.001,PowerShell,Execution,Gamaredon Group|Lazarus Group|Aquatic Panda|Confucius|Dragonfly|LazyScripter|Nomadic Octopus|TeamTNT|APT38|Tonto Team|Mustang Panda|Indrik Spider|HAFNIUM|Sidewinder|Fox Kitten|GOLD SOUTHFIELD|Sandworm Team|Operation Wocao|Chimera|Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|GALLIUM|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|APT19|DarkHydrus|APT28|Turla|Gorgon Group|Thrip|Cobalt Group|Leviathan|MuddyWater|FIN8|TA459|CopyKittens|OilRig|BRONZE BUTLER|Magic Hound|Threat Group-3390|FIN10|APT32|FIN7|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda T1567,Exfiltration Over Web Service,Exfiltration,APT28 T1497.003,Time Based Evasion,Defense Evasion|Discovery,no T1497.002,User Activity Based Checks,Defense Evasion|Discovery,Darkhotel|FIN7 @@ -242,40 +242,40 @@ T1497.001,System Checks,Defense Evasion|Discovery,Lazarus Group|OilRig|Darkhotel T1498.002,Reflection Amplification,Impact,no T1498.001,Direct Network Flood,Impact,no T1566.003,Spearphishing via Service,Initial Access,Lazarus Group|APT29|Ajax Security Team|Magic Hound|Windshift|FIN6|OilRig|Dark Caracal -T1566.002,Spearphishing Link,Initial Access,Lazarus Group|Confucius|LazyScripter|Transparent Tribe|FIN7|APT3|Mustang Panda|ZIRCONIUM|MuddyWater|Sidewinder|Evilnum|Sandworm Team|Wizard Spider|APT1|Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|APT39|FIN4|APT32|Night Dragon|APT28|Cobalt Group|Turla|Dragonfly 2.0|OilRig|Elderwood|APT33|APT29|Leviathan|FIN8|Patchwork|Magic Hound -T1566.001,Spearphishing Attachment,Initial Access,WIRTE|Confucius|Dragonfly|LazyScripter|Threat Group-3390|APT38|Andariel|Ferocious Kitten|IndigoZebra|Transparent Tribe|Nomadic Octopus|Tonto Team|Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|APT1|FIN6|APT30|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|DarkHydrus|Lazarus Group|Gorgon Group|OilRig|BRONZE BUTLER|APT19|APT32|Cobalt Group|Rancor|FIN7|Dragonfly 2.0|MuddyWater|APT28|TA459|APT29|APT37|Leviathan|FIN8|Patchwork|menuPass|Elderwood|PLATINUM -T1566,Phishing,Initial Access,Axiom|GOLD SOUTHFIELD|Dragonfly +T1566.002,Spearphishing Link,Initial Access,Lazarus Group|Confucius|LazyScripter|Transparent Tribe|FIN7|APT3|Mustang Panda|ZIRCONIUM|MuddyWater|Sidewinder|Evilnum|Sandworm Team|Wizard Spider|APT1|Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|APT39|FIN4|APT32|Night Dragon|Cobalt Group|APT28|Turla|OilRig|APT33|Patchwork|Magic Hound|APT29|FIN8|Elderwood|Leviathan +T1566.001,Spearphishing Attachment,Initial Access,WIRTE|Confucius|Dragonfly|LazyScripter|Threat Group-3390|APT38|Andariel|Ferocious Kitten|IndigoZebra|Transparent Tribe|Nomadic Octopus|Tonto Team|Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|APT1|FIN6|APT30|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|APT19|Gorgon Group|Cobalt Group|FIN7|Rancor|APT32|BRONZE BUTLER|OilRig|Lazarus Group|DarkHydrus|Patchwork|APT28|Leviathan|menuPass|APT29|FIN8|PLATINUM|Elderwood|APT37|TA459|MuddyWater +T1566,Phishing,Initial Access,Axiom|GOLD SOUTHFIELD T1565.003,Runtime Data Manipulation,Impact,APT38 T1565.002,Transmitted Data Manipulation,Impact,APT38 T1565.001,Stored Data Manipulation,Impact,APT38 T1565,Data Manipulation,Impact,no -T1564.001,Hidden Files and Directories,Defense Evasion,Transparent Tribe|Mustang Panda|Rocke|APT32|Tropic Trooper|APT28|Lazarus Group +T1564.001,Hidden Files and Directories,Defense Evasion,Transparent Tribe|Mustang Panda|Rocke|APT32|Tropic Trooper|Lazarus Group|APT28 T1564,Hide Artifacts,Defense Evasion,no T1563.002,RDP Hijacking,Lateral Movement,Axiom T1563.001,SSH Hijacking,Lateral Movement,no T1563,Remote Service Session Hijacking,Lateral Movement,no T1518.001,Security Software Discovery,Discovery,Kimsuky|Aquatic Panda|TeamTNT|APT38|Windshift|Sidewinder|Operation Wocao|Wizard Spider|Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon T1069.003,Cloud Groups,Discovery,no -T1069.002,Domain Groups,Discovery,APT29|Dragonfly|Turla|Inception|OilRig|Dragonfly 2.0|Ke3chang +T1069.002,Domain Groups,Discovery,APT29|Dragonfly|Turla|Inception|OilRig|Ke3chang T1087.004,Cloud Account,Discovery,APT29 T1087.003,Email Account,Discovery,Sandworm Team|TA505 -T1087.002,Domain Account,Discovery,APT29|Lazarus Group|Dragonfly|MuddyWater|Fox Kitten|Operation Wocao|Wizard Spider|Chimera|Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang +T1087.002,Domain Account,Discovery,APT29|Lazarus Group|Dragonfly|MuddyWater|Fox Kitten|Operation Wocao|Wizard Spider|Chimera|Turla|Sandworm Team|BRONZE BUTLER|OilRig|menuPass|FIN6|Poseidon Group|Ke3chang T1087.001,Local Account,Discovery,Chimera|Fox Kitten|Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338 T1553.004,Install Root Certificate,Defense Evasion,no -T1562.004,Disable or Modify System Firewall,Defense Evasion,Dragonfly|TeamTNT|APT38|APT29|Operation Wocao|Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak +T1562.004,Disable or Modify System Firewall,Defense Evasion,Dragonfly|TeamTNT|APT38|APT29|Operation Wocao|Rocke|Lazarus Group|Kimsuky|Carbanak T1562.003,Impair Command History Logging,Defense Evasion,APT38 T1562.002,Disable Windows Event Logging,Defense Evasion,Sandworm Team|APT29|Threat Group-3390 T1562.001,Disable or Modify Tools,Defense Evasion,Aquatic Panda|TeamTNT|Indrik Spider|APT29|MuddyWater|Wizard Spider|FIN6|Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda T1562,Impair Defenses,Defense Evasion,no -T1003.004,LSA Secrets,Credential Access,Dragonfly|OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390 +T1003.004,LSA Secrets,Credential Access,Dragonfly|OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|APT33|Threat Group-3390 T1003.005,Cached Domain Credentials,Credential Access,OilRig|MuddyWater|Leafminer|APT33 T1561.002,Disk Structure Wipe,Impact,Sandworm Team|Lazarus Group|APT38|APT37 T1561.001,Disk Content Wipe,Impact,Lazarus Group T1561,Disk Wipe,Impact,no T1560.003,Archive via Custom Method,Collection,Mustang Panda|Lazarus Group|Kimsuky|CopyKittens|FIN6 T1560.002,Archive via Library,Collection,Lazarus Group|Threat Group-3390 -T1560.001,Archive via Utility,Collection,Kimsuky|Aquatic Panda|APT28|APT29|Mustang Panda|HAFNIUM|Fox Kitten|Operation Wocao|Chimera|APT41|GALLIUM|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|APT1|Ke3chang -T1560,Archive Collected Data,Collection,Axiom|Dragonfly|Leviathan|menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang +T1560.001,Archive via Utility,Collection,Kimsuky|Aquatic Panda|APT28|APT29|Mustang Panda|HAFNIUM|Fox Kitten|Operation Wocao|Chimera|APT41|GALLIUM|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|Sowbug|CopyKittens|APT3|BRONZE BUTLER|menuPass|APT1|Ke3chang +T1560,Archive Collected Data,Collection,Axiom|Dragonfly|Leviathan|menuPass|APT32|APT28|Patchwork|Honeybee|FIN6|Lazarus Group|Ke3chang T1499.004,Application or System Exploitation,Impact,no T1499.003,Application Exhaustion Flood,Impact,no T1499.002,Service Exhaustion Flood,Impact,no @@ -283,7 +283,7 @@ T1499.001,OS Exhaustion Flood,Impact,no T1491.002,External Defacement,Impact,Sandworm Team T1491.001,Internal Defacement,Impact,Gamaredon Group|Lazarus Group T1114.003,Email Forwarding Rule,Collection,Silent Librarian|Kimsuky -T1114.002,Remote Email Collection,Collection,Kimsuky|Dragonfly|APT29|HAFNIUM|Chimera|APT1|FIN4|Ke3chang|Leafminer|Dragonfly 2.0|APT28 +T1114.002,Remote Email Collection,Collection,Kimsuky|Dragonfly|APT29|HAFNIUM|Chimera|APT1|FIN4|Leafminer|Ke3chang|APT28 T1114.001,Local Email Collection,Collection,Chimera|Magic Hound|APT1 T1134.005,SID-History Injection,Defense Evasion|Privilege Escalation,no T1134.004,Parent PID Spoofing,Defense Evasion|Privilege Escalation,no @@ -295,7 +295,7 @@ T1213.001,Confluence,Collection,no T1555.003,Credentials from Web Browsers,Credential Access,APT29|Ajax Security Team|ZIRCONIUM|FIN6|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|MuddyWater|APT37|Patchwork|Molerats T1555.002,Securityd Memory,Credential Access,no T1555.001,Keychain,Credential Access,no -T1559.002,Dynamic Data Exchange,Execution,Leviathan|Sidewinder|Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|FIN7|APT28 +T1559.002,Dynamic Data Exchange,Execution,Leviathan|Sidewinder|Sharpshooter|TA505|MuddyWater|Gallmaker|Cobalt Group|Patchwork|APT37|FIN7|APT28 T1559.001,Component Object Model,Execution,Gamaredon Group|MuddyWater T1559,Inter-Process Communication,Execution,no T1558.002,Silver Ticket,Credential Access,no @@ -309,7 +309,7 @@ T1556,Modify Authentication Process,Credential Access|Defense Evasion|Persistenc T1056.004,Credential API Hooking,Collection|Credential Access,PLATINUM T1056.003,Web Portal Capture,Collection|Credential Access,no T1056.002,GUI Input Capture,Collection|Credential Access,FIN4 -T1056.001,Keylogging,Collection|Credential Access,Tonto Team|Ajax Security Team|Operation Wocao|APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|FIN4|APT38|OilRig|Ke3chang|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28 +T1056.001,Keylogging,Collection|Credential Access,Tonto Team|Ajax Security Team|Operation Wocao|APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|FIN4|APT38|Ke3chang|OilRig|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28 T1555,Credentials from Password Stores,Credential Access,APT29|Evilnum|FIN6|APT39|OilRig|MuddyWater|Leafminer|APT33|Stealth Falcon T1552.005,Cloud Instance Metadata API,Credential Access,TeamTNT T1003.008,/etc/passwd and /etc/shadow,Credential Access,no @@ -317,19 +317,19 @@ T1003.007,Proc Filesystem,Credential Access,no T1003.006,DCSync,Credential Access,APT29|Operation Wocao T1558.003,Kerberoasting,Credential Access,FIN7|APT29|Operation Wocao|Wizard Spider T1552.006,Group Policy Preferences,Credential Access,APT33 -T1003.003,NTDS,Credential Access,Ke3chang|Dragonfly|APT28|Mustang Panda|HAFNIUM|Fox Kitten|menuPass|Wizard Spider|Chimera|FIN6|Dragonfly 2.0 -T1003.002,Security Account Manager,Credential Access,Dragonfly|Wizard Spider|Threat Group-3390|Ke3chang|GALLIUM|Night Dragon|Dragonfly 2.0|menuPass -T1003.001,LSASS Memory,Credential Access,Aquatic Panda|Indrik Spider|HAFNIUM|Fox Kitten|Operation Wocao|Kimsuky|Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|GALLIUM|TEMP.Veles|APT33|APT39|APT32|Leafminer|Magic Hound|FIN8|PLATINUM|MuddyWater|OilRig|BRONZE BUTLER|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver +T1003.003,NTDS,Credential Access,Ke3chang|Dragonfly|APT28|Mustang Panda|HAFNIUM|Fox Kitten|menuPass|Wizard Spider|Chimera|FIN6 +T1003.002,Security Account Manager,Credential Access,Dragonfly|Wizard Spider|Threat Group-3390|Ke3chang|GALLIUM|Night Dragon|menuPass +T1003.001,LSASS Memory,Credential Access,Aquatic Panda|Indrik Spider|HAFNIUM|Fox Kitten|Operation Wocao|Kimsuky|Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|GALLIUM|TEMP.Veles|APT33|APT39|APT32|Leafminer|Magic Hound|FIN8|MuddyWater|PLATINUM|OilRig|BRONZE BUTLER|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver T1110.004,Credential Stuffing,Credential Access,Chimera T1110.003,Password Spraying,Credential Access,Sandworm Team|APT29|Silent Librarian|Chimera|APT28|APT33|Leafminer|Lazarus Group -T1110.002,Password Cracking,Credential Access,Dragonfly|FIN6|APT41|Dragonfly 2.0|APT3 +T1110.002,Password Cracking,Credential Access,Dragonfly|FIN6|APT41|APT3 T1110.001,Password Guessing,Credential Access,APT28 T1021.006,Windows Remote Management,Lateral Movement,APT29|Chimera|Wizard Spider|Threat Group-3390 T1021.005,VNC,Lateral Movement,Gamaredon Group|FIN7|Fox Kitten|GCMAN T1021.004,SSH,Lateral Movement,BlackTech|Lazarus Group|TeamTNT|FIN7|Fox Kitten|Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN T1021.003,Distributed Component Object Model,Lateral Movement,no T1021.002,SMB/Windows Admin Shares,Lateral Movement,APT29|Sandworm Team|APT28|Fox Kitten|APT41|Operation Wocao|Wizard Spider|Chimera|Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang -T1021.001,Remote Desktop Protocol,Lateral Movement,APT29|Dragonfly|Kimsuky|FIN7|Fox Kitten|Chimera|Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|FIN10|menuPass|Patchwork|FIN6|Lazarus Group|APT1|Axiom +T1021.001,Remote Desktop Protocol,Lateral Movement,APT29|Dragonfly|Kimsuky|FIN7|Fox Kitten|Chimera|Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Cobalt Group|FIN8|OilRig|APT3|menuPass|FIN10|Patchwork|FIN6|Lazarus Group|APT1|Axiom T1554,Compromise Client Software Binary,Persistence,no T1036.006,Space after Filename,Defense Evasion,no T1036.005,Match Legitimate Name or Location,Defense Evasion,Ke3chang|Kimsuky|Gamaredon Group|WIRTE|APT28|Ferocious Kitten|FIN7|BackdoorDiplomacy|Transparent Tribe|Naikon|APT29|Mustang Panda|Sidewinder|Darkhotel|Lazarus Group|Indrik Spider|Fox Kitten|Machete|Chimera|PROMETHIUM|Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|Sowbug|BRONZE BUTLER|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1 @@ -338,12 +338,12 @@ T1036.003,Rename System Utilities,Defense Evasion,Lazarus Group|menuPass|APT32|G T1036.002,Right-to-Left Override,Defense Evasion,Ferocious Kitten|BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic T1036.001,Invalid Code Signature,Defense Evasion,Windshift|APT37 T1553.003,SIP and Trust Provider Hijacking,Defense Evasion,no -T1553.002,Code Signing,Defense Evasion,Lazarus Group|menuPass|APT29|GALLIUM|Wizard Spider|Kimsuky|PROMETHIUM|Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel +T1553.002,Code Signing,Defense Evasion,Lazarus Group|menuPass|APT29|GALLIUM|Wizard Spider|Kimsuky|PROMETHIUM|Patchwork|Silence|APT41|FIN6|TA505|Honeybee|FIN7|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel T1553.001,Gatekeeper Bypass,Defense Evasion,no T1553,Subvert Trust Controls,Defense Evasion,Axiom T1027.003,Steganography,Defense Evasion,Andariel|Leviathan|TA551|BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37 T1027.002,Software Packing,Defense Evasion,Threat Group-3390|Lazarus Group|Sandworm Team|Kimsuky|TeamTNT|ZIRCONIUM|TA505|Rocke|GALLIUM|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon -T1027.001,Binary Padding,Defense Evasion,APT29|Mustang Panda|Higaisa|Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee +T1027.001,Binary Padding,Defense Evasion,APT29|Mustang Panda|Higaisa|Gamaredon Group|APT32|Patchwork|Leviathan|BRONZE BUTLER|Moafee T1222.002,Linux and Mac File and Directory Permissions Modification,Defense Evasion,TeamTNT|Rocke|APT32 T1222.001,Windows File and Directory Permissions Modification,Defense Evasion,Wizard Spider T1552.004,Private Keys,Credential Access,TeamTNT|APT29|Operation Wocao|Rocke @@ -354,7 +354,7 @@ T1552,Unsecured Credentials,Credential Access,no T1216.001,PubPrn,Defense Evasion,APT32 T1070.006,Timestomp,Defense Evasion,APT38|APT29|Chimera|Kimsuky|Rocke|TEMP.Veles|APT32|Lazarus Group|APT28 T1070.005,Network Share Connection Removal,Defense Evasion,Threat Group-3390 -T1070.004,File Deletion,Defense Evasion,Aquatic Panda|Dragonfly|TeamTNT|APT39|Mustang Panda|Chimera|Evilnum|Operation Wocao|FIN6|Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Cobalt Group|Dragonfly 2.0|Honeybee|Patchwork|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|APT3|Magic Hound|Threat Group-3390|APT28|FIN10|Group5|Lazarus Group|APT18|APT29 +T1070.004,File Deletion,Defense Evasion,Aquatic Panda|Dragonfly|TeamTNT|APT39|Mustang Panda|Chimera|Evilnum|Operation Wocao|FIN6|Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|menuPass|Cobalt Group|FIN8|Magic Hound|FIN5|BRONZE BUTLER|APT3|OilRig|APT28|Threat Group-3390|FIN10|Group5|Lazarus Group|APT18|APT29 T1070.003,Clear Command History,Defense Evasion,Lazarus Group|TeamTNT|menuPass|APT41 T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,APT29 T1550.001,Application Access Token,Defense Evasion|Lateral Movement,APT29|APT28 @@ -363,17 +363,16 @@ T1550.002,Pass the Hash,Defense Evasion|Lateral Movement,Chimera|Kimsuky|GALLIUM T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,APT29 T1548.004,Elevated Execution with Prompt,Privilege Escalation|Defense Evasion,no T1548.003,Sudo and Sudo Caching,Privilege Escalation|Defense Evasion,no -T1548.002,Bypass User Account Control,Privilege Escalation|Defense Evasion,Evilnum|APT37|MuddyWater|Threat Group-3390|Honeybee|Cobalt Group|BRONZE BUTLER|Patchwork|APT29 +T1548.002,Bypass User Account Control,Privilege Escalation|Defense Evasion,Evilnum|APT37|MuddyWater|Threat Group-3390|Cobalt Group|Honeybee|BRONZE BUTLER|Patchwork|APT29 T1548.001,Setuid and Setgid,Privilege Escalation|Defense Evasion,no T1548,Abuse Elevation Control Mechanism,Privilege Escalation|Defense Evasion,no T1136.003,Cloud Account,Persistence,APT29 T1070.002,Clear Linux or Mac System Logs,Defense Evasion,TeamTNT|Rocke -T1070.001,Clear Windows Event Logs,Defense Evasion,Dragonfly|Indrik Spider|Chimera|Operation Wocao|APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28 +T1070.001,Clear Windows Event Logs,Defense Evasion,Dragonfly|Indrik Spider|Chimera|Operation Wocao|APT41|APT38|APT32|FIN8|FIN5|APT28 T1136.002,Domain Account,Persistence,Sandworm Team|HAFNIUM|GALLIUM -T1136.001,Local Account,Persistence,Kimsuky|Dragonfly|TeamTNT|Fox Kitten|APT39|APT41|Leafminer|Dragonfly 2.0|APT3 -T1547.011,Plist Modification,Persistence|Privilege Escalation,no +T1136.001,Local Account,Persistence,Kimsuky|Dragonfly|TeamTNT|Fox Kitten|APT39|APT41|Leafminer|APT3 T1547.010,Port Monitors,Persistence|Privilege Escalation,no -T1547.009,Shortcut Modification,Persistence|Privilege Escalation,Dragonfly|APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Lazarus Group|Leviathan +T1547.009,Shortcut Modification,Persistence|Privilege Escalation,Dragonfly|APT39|Darkhotel|APT29|Gorgon Group|Lazarus Group|Leviathan T1547.008,LSASS Driver,Persistence|Privilege Escalation,no T1547.007,Re-opened Applications,Persistence|Privilege Escalation,no T1547.006,Kernel Modules and Extensions,Persistence|Privilege Escalation,no @@ -397,27 +396,27 @@ T1546.004,Unix Shell Configuration Modification,Privilege Escalation|Persistence T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,FIN8|Mustang Panda|APT33|Blue Mockingbird|Turla|Leviathan|APT29 T1546.002,Screensaver,Privilege Escalation|Persistence,no T1546.001,Change Default File Association,Privilege Escalation|Persistence,Kimsuky -T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,Confucius|Dragonfly|LazyScripter|TeamTNT|Naikon|Windshift|Mustang Panda|ZIRCONIUM|Higaisa|Sidewinder|APT28|Wizard Spider|PROMETHIUM|Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Kimsuky|APT33|APT39|APT32|APT18|Dark Caracal|Threat Group-3390|Honeybee|Turla|Cobalt Group|Ke3chang|Dragonfly 2.0|APT19|Gorgon Group|MuddyWater|APT37|Leviathan|BRONZE BUTLER|APT3|Magic Hound|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel +T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,Confucius|Dragonfly|LazyScripter|TeamTNT|Naikon|Windshift|Mustang Panda|ZIRCONIUM|Higaisa|Sidewinder|APT28|Wizard Spider|PROMETHIUM|Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Kimsuky|APT33|APT39|APT32|APT18|Dark Caracal|Gorgon Group|Honeybee|Cobalt Group|Threat Group-3390|Turla|Ke3chang|APT19|MuddyWater|APT37|Leviathan|Magic Hound|APT3|BRONZE BUTLER|FIN7|FIN10|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel T1218.002,Control Panel,Defense Evasion,no T1218.010,Regsvr32,Defense Evasion,Kimsuky|Lazarus Group|TA551|Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda T1218.009,Regsvcs/Regasm,Defense Evasion,no T1218.005,Mshta,Defense Evasion,Gamaredon Group|Confucius|Lazarus Group|APT29|LazyScripter|Mustang Panda|TA551|Sidewinder|Inception|Kimsuky|APT32|MuddyWater|FIN7 T1218.004,InstallUtil,Defense Evasion,Mustang Panda|menuPass -T1218.001,Compiled HTML File,Defense Evasion,APT38|APT41|Silence|Dark Caracal|OilRig|Lazarus Group +T1218.001,Compiled HTML File,Defense Evasion,APT38|APT41|Silence|OilRig|Dark Caracal T1218.003,CMSTP,Defense Evasion,Cobalt Group|MuddyWater T1218.011,Rundll32,Defense Evasion,Kimsuky|Lazarus Group|LazyScripter|APT38|HAFNIUM|TA551|APT41|Gamaredon Group|APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28 T1547,Boot or Logon Autostart Execution,Persistence|Privilege Escalation,no T1546,Event Triggered Execution,Privilege Escalation|Persistence,no -T1098.003,Add Office 365 Global Administrator Role,Persistence,APT29 -T1098.002,Exchange Email Delegate Permissions,Persistence,APT28|APT29|Magic Hound +T1098.003,Additional Cloud Roles,Persistence,APT29 +T1098.002,Additional Email Delegate Permissions,Persistence,APT28|APT29|Magic Hound T1098.001,Additional Cloud Credentials,Persistence,APT29 T1543.004,Launch Daemon,Persistence|Privilege Escalation,no -T1543.003,Windows Service,Persistence|Privilege Escalation,TeamTNT|APT38|PROMETHIUM|Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|FIN7|APT19|Threat Group-3390|Honeybee|APT3|Lazarus Group|Carbanak +T1543.003,Windows Service,Persistence|Privilege Escalation,TeamTNT|APT38|PROMETHIUM|Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Threat Group-3390|Ke3chang|Cobalt Group|Honeybee|APT19|FIN7|APT3|Lazarus Group|Carbanak T1543.002,Systemd Service,Persistence|Privilege Escalation,TeamTNT|Rocke T1543.001,Launch Agent,Persistence|Privilege Escalation,no T1037.005,Startup Items,Persistence|Privilege Escalation,no T1037.004,RC Scripts,Persistence|Privilege Escalation,no -T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Kimsuky|Threat Group-3390|menuPass|Gorgon Group|Patchwork +T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Kimsuky|Threat Group-3390|Gorgon Group|menuPass|Patchwork T1055.013,Process Doppelgänging,Defense Evasion|Privilege Escalation,Leafminer T1055.011,Extra Window Memory Injection,Defense Evasion|Privilege Escalation,no T1055.014,VDSO Hijacking,Defense Evasion|Privilege Escalation,no @@ -430,18 +429,17 @@ T1055.002,Portable Executable Injection,Defense Evasion|Privilege Escalation,Roc T1055.001,Dynamic-link Library Injection,Defense Evasion|Privilege Escalation,BackdoorDiplomacy|Leviathan|Wizard Spider|TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda T1037.003,Network Logon Script,Persistence|Privilege Escalation,no T1543,Create or Modify System Process,Persistence|Privilege Escalation,no -T1037.002,Logon Script (Mac),Persistence|Privilege Escalation,no +T1037.002,Login Hook,Persistence|Privilege Escalation,no T1037.001,Logon Script (Windows),Persistence|Privilege Escalation,Cobalt Group|APT28 T1542.003,Bootkit,Persistence|Defense Evasion,APT41|Lazarus Group|APT28 T1542.002,Component Firmware,Persistence|Defense Evasion,Equation T1542.001,System Firmware,Persistence|Defense Evasion,no -T1505.003,Web Shell,Persistence,Dragonfly|BackdoorDiplomacy|APT38|APT29|APT28|Tonto Team|Sandworm Team|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|Kimsuky|Tropic Trooper|GALLIUM|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda +T1505.003,Web Shell,Persistence,Dragonfly|BackdoorDiplomacy|APT38|APT29|APT28|Tonto Team|Sandworm Team|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|Kimsuky|Tropic Trooper|GALLIUM|Threat Group-3390|TEMP.Veles|Leviathan|APT39|OilRig|APT32|Deep Panda T1505.002,Transport Agent,Persistence,no T1505.001,SQL Stored Procedures,Persistence,Sandworm Team T1053.003,Cron,Execution|Persistence|Privilege Escalation,APT38|Rocke -T1053.001,At (Linux),Execution|Persistence|Privilege Escalation,no -T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,Kimsuky|Lazarus Group|Confucius|Dragonfly|APT37|APT38|Naikon|CostaRicto|Mustang Panda|Higaisa|Fox Kitten|Molerats|Machete|Operation Wocao|Chimera|Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|GALLIUM|Silence|TEMP.Veles|APT33|APT39|Rancor|OilRig|Patchwork|Dragonfly 2.0|Cobalt Group|FIN8|menuPass|FIN10|FIN7|APT32|Stealth Falcon|FIN6|APT3|APT29 -T1053.002,At (Windows),Execution|Persistence|Privilege Escalation,BRONZE BUTLER|Threat Group-3390|APT18 +T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,Kimsuky|Lazarus Group|Confucius|Dragonfly|APT37|APT38|Naikon|CostaRicto|Mustang Panda|Higaisa|Fox Kitten|Molerats|Machete|Operation Wocao|Chimera|Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|GALLIUM|Silence|TEMP.Veles|APT33|APT39|OilRig|Rancor|Cobalt Group|Patchwork|FIN8|FIN10|menuPass|APT32|FIN7|Stealth Falcon|FIN6|APT3|APT29 +T1053.002,At,Execution|Persistence|Privilege Escalation,BRONZE BUTLER|Threat Group-3390|APT18 T1542,Pre-OS Boot,Defense Evasion|Persistence,no T1137.001,Office Template Macros,Persistence,MuddyWater T1137.004,Outlook Home Page,Persistence,OilRig @@ -477,38 +475,38 @@ T1485,Data Destruction,Impact,Gamaredon Group|Sandworm Team|Lazarus Group|APT38 T1484,Domain Policy Modification,Defense Evasion|Privilege Escalation,no T1482,Domain Trust Discovery,Discovery,FIN8|APT29|Chimera T1480,Execution Guardrails,Defense Evasion,no -T1221,Template Injection,Defense Evasion,Lazarus Group|Confucius|Dragonfly|Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|DarkHydrus|Dragonfly 2.0 -T1222,File and Directory Permissions Modification,Defense Evasion,no +T1221,Template Injection,Defense Evasion,Lazarus Group|Confucius|Dragonfly|Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|DarkHydrus T1220,XSL Script Processing,Defense Evasion,Lazarus Group|Higaisa|Cobalt Group -T1217,Browser Bookmark Discovery,Discovery,APT38|Chimera|Fox Kitten -T1212,Exploitation for Credential Access,Credential Access,no -T1189,Drive-by Compromise,Initial Access,Magic Hound|APT28|Axiom|Transparent Tribe|Andariel|Leviathan|Machete|Windigo|Dragonfly|PROMETHIUM|Turla|Windshift|RTM|Darkhotel|APT38|APT19|Lazarus Group|Threat Group-3390|BRONZE BUTLER|APT32|Dark Caracal|Dragonfly 2.0|Leafminer|Patchwork|APT37|Elderwood|PLATINUM -T1211,Exploitation for Defense Evasion,Defense Evasion,APT28 -T1197,BITS Jobs,Defense Evasion|Persistence,APT39|Patchwork|APT41|Leviathan -T1203,Exploitation for Client Execution,Execution,Axiom|Confucius|Dragonfly|Andariel|Transparent Tribe|APT3|Tonto Team|Mustang Panda|Darkhotel|Higaisa|HAFNIUM|Sidewinder|Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Cobalt Group|Lazarus Group|Patchwork|Elderwood|APT29|TA459|APT37|Leviathan -T1201,Password Policy Discovery,Discovery,Chimera|Turla|OilRig -T1195,Supply Chain Compromise,Initial Access,no -T1199,Trusted Relationship,Initial Access,Threat Group-3390|APT29|Sandworm Team|GOLD SOUTHFIELD|APT28|menuPass -T1218,Signed Binary Proxy Execution,Defense Evasion,Lazarus Group -T1204,User Execution,Execution,no -T1213,Data from Information Repositories,Collection,APT29|APT28|Fox Kitten|FIN6|Turla -T1190,Exploit Public-Facing Application,Initial Access,Threat Group-3390|Ke3chang|Kimsuky|Magic Hound|Dragonfly|BackdoorDiplomacy|menuPass|Volatile Cedar|Fox Kitten|Operation Wocao|APT28|APT29|GOLD SOUTHFIELD|Blue Mockingbird|Rocke|APT39|BlackTech|APT41|GALLIUM|Night Dragon|Axiom -T1210,Exploitation of Remote Services,Lateral Movement,Dragonfly|Tonto Team|FIN7|Fox Kitten|menuPass|Wizard Spider|Threat Group-3390|APT28 -T1200,Hardware Additions,Initial Access,DarkVishnya +T1222,File and Directory Permissions Modification,Defense Evasion,no T1202,Indirect Command Execution,Defense Evasion,Lazarus Group +T1195,Supply Chain Compromise,Initial Access,no T1219,Remote Access Software,Command And Control,TeamTNT|Mustang Panda|MuddyWater|Evilnum|GOLD SOUTHFIELD|Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Cobalt Group|Thrip|Carbanak +T1213,Data from Information Repositories,Collection,APT29|APT28|Fox Kitten|FIN6|Turla +T1200,Hardware Additions,Initial Access,DarkVishnya +T1216,System Script Proxy Execution,Defense Evasion,no +T1190,Exploit Public-Facing Application,Initial Access,Threat Group-3390|Ke3chang|Kimsuky|Magic Hound|Dragonfly|BackdoorDiplomacy|menuPass|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|APT28|APT29|GOLD SOUTHFIELD|Blue Mockingbird|Rocke|APT39|BlackTech|APT41|GALLIUM|Night Dragon|Axiom +T1201,Password Policy Discovery,Discovery,Chimera|Turla|OilRig +T1218,System Binary Proxy Execution,Defense Evasion,Lazarus Group T1207,Rogue Domain Controller,Defense Evasion,no -T1216,Signed Script Proxy Execution,Defense Evasion,no +T1199,Trusted Relationship,Initial Access,Threat Group-3390|APT29|Sandworm Team|GOLD SOUTHFIELD|APT28|menuPass T1205,Traffic Signaling,Defense Evasion|Persistence|Command And Control,no +T1217,Browser Bookmark Discovery,Discovery,APT38|Chimera|Fox Kitten +T1204,User Execution,Execution,no +T1210,Exploitation of Remote Services,Lateral Movement,Dragonfly|Tonto Team|FIN7|Fox Kitten|menuPass|Wizard Spider|Threat Group-3390|APT28 +T1189,Drive-by Compromise,Initial Access,Magic Hound|APT28|Axiom|Transparent Tribe|Andariel|Leviathan|Machete|Windigo|Dragonfly|PROMETHIUM|Turla|Windshift|RTM|Darkhotel|APT38|BRONZE BUTLER|Dark Caracal|Leafminer|APT32|APT19|Lazarus Group|Threat Group-3390|Patchwork|Elderwood|APT37|PLATINUM +T1211,Exploitation for Defense Evasion,Defense Evasion,APT28 +T1212,Exploitation for Credential Access,Credential Access,no +T1203,Exploitation for Client Execution,Execution,Axiom|Confucius|Dragonfly|Andariel|Transparent Tribe|APT3|Tonto Team|Mustang Panda|Darkhotel|Higaisa|Sidewinder|Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|Lazarus Group|Cobalt Group|BRONZE BUTLER|Elderwood|APT37|Leviathan|Patchwork|TA459|APT29 +T1197,BITS Jobs,Defense Evasion|Persistence,APT39|Patchwork|APT41|Leviathan T1176,Browser Extensions,Persistence,Kimsuky -T1187,Forced Authentication,Credential Access,Dragonfly|DarkHydrus|Dragonfly 2.0 T1185,Browser Session Hijacking,Collection,no -T1140,Deobfuscate/Decode Files or Information,Defense Evasion,Lazarus Group|Ke3chang|Kimsuky|APT39|APT29|ZIRCONIUM|Higaisa|Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|Honeybee|Gorgon Group|Threat Group-3390|menuPass|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER +T1187,Forced Authentication,Credential Access,Dragonfly|DarkHydrus +T1140,Deobfuscate/Decode Files or Information,Defense Evasion,Lazarus Group|Ke3chang|Kimsuky|APT39|APT29|ZIRCONIUM|Higaisa|Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|menuPass|Gorgon Group|Threat Group-3390|APT19|Honeybee|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER +T1137,Office Application Startup,Persistence,Gamaredon Group|APT32 T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,FIN6|Blue Mockingbird T1136,Create Account,Persistence,Sandworm Team|Indrik Spider -T1135,Network Share Discovery,Discovery,Dragonfly|Tonto Team|APT38|Chimera|Operation Wocao|Wizard Spider|APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug -T1137,Office Application Startup,Persistence,Gamaredon Group|APT32 -T1133,External Remote Services,Persistence|Initial Access,Dragonfly|TeamTNT|Leviathan|APT28|APT29|Operation Wocao|Wizard Spider|Kimsuky|GOLD SOUTHFIELD|Chimera|Sandworm Team|APT41|GALLIUM|TEMP.Veles|Night Dragon|Ke3chang|OilRig|Dragonfly 2.0|FIN5|Threat Group-3390|APT18 +T1135,Network Share Discovery,Discovery,Dragonfly|Tonto Team|APT38|Chimera|Operation Wocao|Wizard Spider|APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Sowbug +T1133,External Remote Services,Persistence|Initial Access,Dragonfly|TeamTNT|Leviathan|APT28|APT29|Operation Wocao|Wizard Spider|Kimsuky|GOLD SOUTHFIELD|Chimera|Sandworm Team|APT41|GALLIUM|TEMP.Veles|Night Dragon|Ke3chang|OilRig|FIN5|Threat Group-3390|APT18 T1132,Data Encoding,Command And Control,no T1129,Shared Modules,Execution,no T1127,Trusted Developer Utilities Proxy Execution,Defense Evasion,no @@ -516,64 +514,64 @@ T1125,Video Capture,Collection,Silence|FIN7 T1124,System Time Discovery,Discovery,Darkhotel|ZIRCONIUM|Higaisa|Sidewinder|Chimera|Operation Wocao|The White Company|Lazarus Group|BRONZE BUTLER|Turla T1123,Audio Capture,Collection,APT37 T1120,Peripheral Device Discovery,Discovery,OilRig|BackdoorDiplomacy|Operation Wocao|Turla|APT37|Gamaredon Group|Equation|APT28 -T1119,Automated Collection,Collection,Ke3chang|Confucius|Mustang Panda|Sidewinder|Chimera|menuPass|Operation Wocao|Gamaredon Group|Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6 +T1119,Automated Collection,Collection,Ke3chang|Confucius|Mustang Panda|Sidewinder|Chimera|menuPass|Operation Wocao|Gamaredon Group|Tropic Trooper|Frankenstein|APT1|Patchwork|APT28|FIN5|OilRig|Threat Group-3390|FIN6 T1115,Clipboard Data,Collection,Operation Wocao|APT39|APT38 T1114,Email Collection,Collection,Magic Hound|Silent Librarian -T1113,Screen Capture,Collection,Dragonfly|GOLD SOUTHFIELD|Gamaredon Group|APT39|Silence|MuddyWater|Dragonfly 2.0|OilRig|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28 -T1112,Modify Registry,Defense Evasion,Dragonfly|Operation Wocao|Kimsuky|Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Patchwork|Gorgon Group|Threat Group-3390|Dragonfly 2.0|APT19|Honeybee|FIN8 -T1111,Two-Factor Authentication Interception,Credential Access,Kimsuky|Chimera|Operation Wocao +T1113,Screen Capture,Collection,Dragonfly|GOLD SOUTHFIELD|Gamaredon Group|APT39|Silence|MuddyWater|FIN7|OilRig|Dark Caracal|Magic Hound|BRONZE BUTLER|Group5|APT28 +T1112,Modify Registry,Defense Evasion,Dragonfly|Operation Wocao|Kimsuky|Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|APT19|Threat Group-3390|Patchwork|Honeybee|Gorgon Group|FIN8 +T1111,Multi-Factor Authentication Interception,Credential Access,Kimsuky|Chimera|Operation Wocao T1110,Brute Force,Credential Access,Lazarus Group|Dragonfly|APT38|APT28|Fox Kitten|DarkVishnya|APT39|OilRig|FIN5|Turla T1106,Native API,Execution,BlackTech|Lazarus Group|APT38|Higaisa|menuPass|Operation Wocao|Chimera|Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|APT37|Gorgon Group -T1105,Ingress Tool Transfer,Command And Control,LazyScripter|Ke3chang|Aquatic Panda|Winnti Group|Confucius|Dragonfly|TeamTNT|Nomadic Octopus|IndigoZebra|Andariel|BackdoorDiplomacy|Tonto Team|HAFNIUM|APT29|Ajax Security Team|Mustang Panda|Windshift|Darkhotel|ZIRCONIUM|TA551|Volatile Cedar|Indrik Spider|Evilnum|Sidewinder|Fox Kitten|Kimsuky|Operation Wocao|Chimera|Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|GALLIUM|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Gorgon Group|OilRig|Turla|Cobalt Group|Dragonfly 2.0|FIN8|PLATINUM|APT37|Elderwood|Leviathan|APT32|Magic Hound|BRONZE BUTLER|APT3|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28 +T1105,Ingress Tool Transfer,Command And Control,LazyScripter|Ke3chang|Aquatic Panda|Winnti Group|Confucius|Dragonfly|TeamTNT|Nomadic Octopus|IndigoZebra|Andariel|BackdoorDiplomacy|Tonto Team|HAFNIUM|APT29|Ajax Security Team|Mustang Panda|Windshift|Darkhotel|ZIRCONIUM|TA551|Volatile Cedar|Indrik Spider|Evilnum|Sidewinder|Fox Kitten|Kimsuky|Operation Wocao|Chimera|Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|GALLIUM|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Gorgon Group|Turla|Cobalt Group|Rancor|OilRig|Leviathan|Elderwood|APT37|PLATINUM|FIN8|APT32|Magic Hound|BRONZE BUTLER|APT3|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28 T1104,Multi-Stage Channels,Command And Control,Lazarus Group|APT41|MuddyWater|APT3 T1102,Web Service,Command And Control,Mustang Panda|LazyScripter|TeamTNT|FIN8|Fox Kitten|Turla|APT32|Gamaredon Group|Rocke|Inception|FIN6 -T1098,Account Manipulation,Persistence,Kimsuky|Dragonfly|Sandworm Team|APT3|Dragonfly 2.0|Lazarus Group +T1098,Account Manipulation,Persistence,Kimsuky|Dragonfly|Sandworm Team|APT3|Lazarus Group T1095,Non-Application Layer Protocol,Command And Control,BackdoorDiplomacy|HAFNIUM|Operation Wocao|FIN6|APT29|PLATINUM|APT3 T1092,Communication Through Removable Media,Command And Control,APT28 T1091,Replication Through Removable Media,Lateral Movement|Initial Access,FIN7|Mustang Panda|Tropic Trooper|Darkhotel|APT28 T1090,Proxy,Command And Control,Windigo|Fox Kitten|Operation Wocao|Sandworm Team|Blue Mockingbird|APT41|Turla T1087,Account Discovery,Discovery,APT29 -T1083,File and Directory Discovery,Discovery,Winnti Group|Confucius|Dragonfly|APT38|APT29|Mustang Panda|Darkhotel|Windigo|Sidewinder|Chimera|Fox Kitten|menuPass|APT39|Sandworm Team|Operation Wocao|Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dark Caracal|Dragonfly 2.0|APT3|Sowbug|Magic Hound|BRONZE BUTLER|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang -T1082,System Information Discovery,Discovery,Aquatic Panda|Confucius|TeamTNT|APT38|APT29|Mustang Panda|Windshift|ZIRCONIUM|Higaisa|Windigo|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|APT32|APT37|Honeybee|APT19|Magic Hound|Sowbug|OilRig|APT3|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang +T1083,File and Directory Discovery,Discovery,Winnti Group|Confucius|Dragonfly|APT38|APT29|Mustang Panda|Darkhotel|Windigo|Sidewinder|Chimera|Fox Kitten|menuPass|APT39|Sandworm Team|Operation Wocao|Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Dark Caracal|Leafminer|Honeybee|BRONZE BUTLER|Sowbug|Magic Hound|APT3|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang +T1082,System Information Discovery,Discovery,Aquatic Panda|Confucius|TeamTNT|APT38|APT29|Mustang Panda|Windshift|ZIRCONIUM|Higaisa|Windigo|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|APT19|APT32|Honeybee|APT37|APT3|OilRig|Sowbug|Magic Hound|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang T1080,Taint Shared Content,Lateral Movement,Gamaredon Group|BRONZE BUTLER|Darkhotel -T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Ke3chang|Lazarus Group|Axiom|Dragonfly|FIN7|Leviathan|APT29|Silent Librarian|Fox Kitten|Operation Wocao|Chimera|Sandworm Team|Wizard Spider|Silence|APT41|GALLIUM|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|APT33|FIN5|OilRig|APT28|menuPass|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak +T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Ke3chang|Lazarus Group|Axiom|Dragonfly|FIN7|Leviathan|APT29|Silent Librarian|Fox Kitten|Operation Wocao|Chimera|Sandworm Team|Wizard Spider|Silence|APT41|GALLIUM|TEMP.Veles|APT39|FIN4|Night Dragon|FIN8|APT33|OilRig|FIN5|FIN10|APT28|menuPass|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak T1074,Data Staged,Collection,Wizard Spider T1072,Software Deployment Tools,Execution|Lateral Movement,Silence|APT32|Threat Group-1314 -T1071,Application Layer Protocol,Command And Control,Dragonfly|TeamTNT|Rocke|Magic Hound|Dragonfly 2.0 +T1071,Application Layer Protocol,Command And Control,Dragonfly|TeamTNT|Rocke|Magic Hound T1070,Indicator Removal on Host,Defense Evasion,Lazarus Group|APT29 T1069,Permission Groups Discovery,Discovery,APT29|TA505|APT3 -T1068,Exploitation for Privilege Escalation,Privilege Escalation,APT29|Tonto Team|ZIRCONIUM|Turla|Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28 -T1059,Command and Scripting Interpreter,Execution,Dragonfly|APT37|Windigo|Fox Kitten|APT32|Whitefly|APT39|Dragonfly 2.0|FIN7|APT19|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang -T1057,Process Discovery,Discovery,Gamaredon Group|Kimsuky|TeamTNT|Andariel|APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|Chimera|Operation Wocao|Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang +T1068,Exploitation for Privilege Escalation,Privilege Escalation,APT29|Tonto Team|ZIRCONIUM|Turla|Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|Threat Group-3390|APT32|FIN6|APT28 +T1059,Command and Scripting Interpreter,Execution,Dragonfly|APT37|Windigo|Fox Kitten|APT32|Whitefly|APT39|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang +T1057,Process Discovery,Discovery,Gamaredon Group|Kimsuky|TeamTNT|Andariel|APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|Chimera|Operation Wocao|Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|Magic Hound|APT3|OilRig|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang T1056,Input Capture,Collection|Credential Access,APT39 -T1055,Process Injection,Defense Evasion|Privilege Escalation,Operation Wocao|APT32|Sharpshooter|Silence|APT41|Kimsuky|Cobalt Group|Turla|APT37|Honeybee|PLATINUM +T1055,Process Injection,Defense Evasion|Privilege Escalation,Operation Wocao|APT32|Sharpshooter|Silence|APT41|Kimsuky|Cobalt Group|APT37|Turla|Honeybee|PLATINUM T1053,Scheduled Task/Job,Execution|Persistence|Privilege Escalation,no T1052,Exfiltration Over Physical Medium,Exfiltration,no -T1049,System Network Connections Discovery,Discovery,Lazarus Group|TeamTNT|Andariel|BackdoorDiplomacy|Mustang Panda|MuddyWater|Chimera|Sandworm Team|Operation Wocao|Tropic Trooper|APT41|APT38|GALLIUM|APT32|APT1|OilRig|APT3|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang +T1049,System Network Connections Discovery,Discovery,Lazarus Group|TeamTNT|Andariel|BackdoorDiplomacy|Mustang Panda|MuddyWater|Chimera|Sandworm Team|Operation Wocao|Tropic Trooper|APT41|APT38|GALLIUM|APT32|APT1|OilRig|APT3|Threat Group-3390|menuPass|Poseidon Group|admin@338|Turla|Ke3chang T1048,Exfiltration Over Alternative Protocol,Exfiltration,no -T1047,Windows Management Instrumentation,Execution,Gamaredon Group|Sandworm Team|FIN7|Indrik Spider|Naikon|Mustang Panda|Windshift|Operation Wocao|Chimera|Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|GALLIUM|APT32|MuddyWater|Threat Group-3390|OilRig|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda -T1046,Network Service Scanning,Discovery,BlackTech|Lazarus Group|TeamTNT|BackdoorDiplomacy|Naikon|CostaRicto|Chimera|Fox Kitten|Operation Wocao|Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|OilRig|Cobalt Group|Leafminer|menuPass|Suckfly|FIN6|Threat Group-3390 +T1047,Windows Management Instrumentation,Execution,Gamaredon Group|Sandworm Team|FIN7|Indrik Spider|Naikon|Mustang Panda|Windshift|Operation Wocao|Chimera|Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|GALLIUM|APT32|MuddyWater|OilRig|Threat Group-3390|Leviathan|FIN8|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda +T1046,Network Service Discovery,Discovery,BlackTech|Lazarus Group|TeamTNT|BackdoorDiplomacy|Naikon|CostaRicto|Chimera|Fox Kitten|Operation Wocao|Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|Leafminer|Cobalt Group|OilRig|menuPass|Suckfly|FIN6|Threat Group-3390 T1041,Exfiltration Over C2 Channel,Exfiltration,Confucius|Leviathan|ZIRCONIUM|Higaisa|Chimera|APT39|Operation Wocao|Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|GALLIUM|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang T1040,Network Sniffing,Credential Access|Discovery,Kimsuky|Sandworm Team|DarkVishnya|APT33|APT28 T1039,Data from Network Shared Drive,Collection,APT28|Chimera|Fox Kitten|Gamaredon Group|BRONZE BUTLER|Sowbug|menuPass T1037,Boot or Logon Initialization Scripts,Persistence|Privilege Escalation,Rocke -T1036,Masquerading,Defense Evasion,Kimsuky|Lazarus Group|Dragonfly|LazyScripter|APT28|Nomadic Octopus|OilRig|APT29|ZIRCONIUM|TA551|Windshift|APT32|BRONZE BUTLER|menuPass|PLATINUM|Dragonfly 2.0 -T1033,System Owner/User Discovery,Discovery,Threat Group-3390|Ke3chang|Dragonfly|APT38|Windshift|ZIRCONIUM|Sidewinder|Chimera|Sandworm Team|Operation Wocao|Wizard Spider|Frankenstein|APT41|GALLIUM|Tropic Trooper|APT39|MuddyWater|APT37|Dragonfly 2.0|APT19|APT32|Magic Hound|OilRig|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3 +T1036,Masquerading,Defense Evasion,Kimsuky|Lazarus Group|Dragonfly|LazyScripter|APT28|Nomadic Octopus|OilRig|APT29|ZIRCONIUM|TA551|Windshift|APT32|BRONZE BUTLER|menuPass|PLATINUM +T1033,System Owner/User Discovery,Discovery,Threat Group-3390|Ke3chang|Dragonfly|APT38|Windshift|ZIRCONIUM|Sidewinder|Chimera|Sandworm Team|Operation Wocao|Wizard Spider|Frankenstein|APT41|GALLIUM|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3 T1030,Data Transfer Size Limits,Exfiltration,APT28|Threat Group-3390 T1029,Scheduled Transfer,Exfiltration,Higaisa -T1027,Obfuscated Files or Information,Defense Evasion,Aquatic Panda|Ke3chang|LazyScripter|TeamTNT|BackdoorDiplomacy|Transparent Tribe|APT39|Mustang Panda|Windshift|TA551|Higaisa|Sidewinder|Fox Kitten|GOLD SOUTHFIELD|Operation Wocao|Kimsuky|FIN6|Chimera|Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|GALLIUM|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Patchwork|menuPass|APT37|Threat Group-3390|Cobalt Group|Dark Caracal|Leafminer|Honeybee|APT19|BlackOasis|Leviathan|FIN8|MuddyWater|FIN7|Elderwood|OilRig|Magic Hound|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28 +T1027,Obfuscated Files or Information,Defense Evasion,Aquatic Panda|Ke3chang|LazyScripter|TeamTNT|BackdoorDiplomacy|Transparent Tribe|APT39|Mustang Panda|Windshift|TA551|Higaisa|Sidewinder|Fox Kitten|GOLD SOUTHFIELD|Operation Wocao|Kimsuky|FIN6|Chimera|Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|GALLIUM|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|APT37|Cobalt Group|Dark Caracal|menuPass|Leafminer|Honeybee|APT19|Threat Group-3390|Patchwork|Elderwood|MuddyWater|Leviathan|FIN7|BlackOasis|FIN8|OilRig|APT3|Magic Hound|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28 T1025,Data from Removable Media,Collection,Turla|Gamaredon Group|APT28 T1021,Remote Services,Lateral Movement,no T1020,Automated Exfiltration,Exfiltration,Ke3chang|Sidewinder|Gamaredon Group|Tropic Trooper|Frankenstein|Honeybee -T1018,Remote System Discovery,Discovery,Dragonfly|Indrik Spider|Naikon|APT29|Chimera|Fox Kitten|Operation Wocao|Sandworm Team|Rocke|Wizard Spider|Silence|GALLIUM|APT39|APT32|Deep Panda|Ke3chang|Threat Group-3390|Dragonfly 2.0|Leafminer|FIN8|FIN5|APT3|BRONZE BUTLER|menuPass|FIN6|Turla -T1016,System Network Configuration Discovery,Discovery,Kimsuky|Dragonfly|TeamTNT|ZIRCONIUM|Mustang Panda|Higaisa|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Sandworm Team|Tropic Trooper|Frankenstein|APT41|GALLIUM|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|Magic Hound|OilRig|Threat Group-3390|menuPass|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang +T1018,Remote System Discovery,Discovery,Dragonfly|Indrik Spider|Naikon|APT29|Chimera|Fox Kitten|Operation Wocao|Sandworm Team|Rocke|Wizard Spider|Silence|GALLIUM|APT39|APT32|Leafminer|Ke3chang|Threat Group-3390|Deep Panda|FIN8|BRONZE BUTLER|FIN5|APT3|menuPass|FIN6|Turla +T1016,System Network Configuration Discovery,Discovery,Kimsuky|Dragonfly|TeamTNT|ZIRCONIUM|Mustang Panda|Higaisa|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Sandworm Team|Tropic Trooper|Frankenstein|APT41|GALLIUM|APT32|Darkhotel|MuddyWater|APT1|APT19|Magic Hound|OilRig|Threat Group-3390|menuPass|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang T1014,Rootkit,Defense Evasion,TeamTNT|Rocke|APT41|APT28|Winnti Group -T1012,Query Registry,Discovery,Kimsuky|Dragonfly|ZIRCONIUM|Chimera|Fox Kitten|APT39|Operation Wocao|APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla +T1012,Query Registry,Discovery,Kimsuky|Dragonfly|ZIRCONIUM|Chimera|Fox Kitten|APT39|Operation Wocao|APT32|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla T1011,Exfiltration Over Other Network Medium,Exfiltration,no T1010,Application Window Discovery,Discovery,Lazarus Group T1008,Fallback Channels,Command And Control,FIN7|APT41|OilRig|Lazarus Group T1007,System Service Discovery,Discovery,Kimsuky|Aquatic Panda|Indrik Spider|Chimera|Operation Wocao|BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang T1006,Direct Volume Access,Defense Evasion,no -T1005,Data from Local System,Collection,Axiom|Dragonfly|FIN7|APT41|APT38|Andariel|APT29|Windigo|Fox Kitten|Sandworm Team|Operation Wocao|FIN6|Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|GALLIUM|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang +T1005,Data from Local System,Collection,Axiom|Dragonfly|FIN7|APT41|APT38|Andariel|APT29|Windigo|Fox Kitten|Sandworm Team|Operation Wocao|FIN6|Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|GALLIUM|Turla|menuPass|Honeybee|Dark Caracal|APT37|APT28|BRONZE BUTLER|APT3|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang T1003,OS Credential Dumping,Credential Access,Tonto Team|APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom -T1001,Data Obfuscation,Command And Control,Operation Wocao|Axiom +T1001,Data Obfuscation,Command And Control,Operation Wocao diff --git a/docs/_pages/detections.md b/docs/_pages/detections.md index 44a47ad556..bf76534087 100644 --- a/docs/_pages/detections.md +++ b/docs/_pages/detections.md @@ -805,6 +805,7 @@ sidebar: | [WinEvent Windows Task Scheduler Event Action Started](/endpoint/winevent_windows_task_scheduler_event_action_started/) | [Scheduled Task](/tags/#scheduled-task) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [WinRM Spawning a Process](/endpoint/winrm_spawning_a_process/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows AdFind Exe](/endpoint/windows_adfind_exe/) | [Remote System Discovery](/tags/#remote-system-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows Command and Scripting Interpreter Path Traversal Exec](/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Computer Account Created by Computer Account](/endpoint/windows_computer_account_created_by_computer_account/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Computer Account Requesting Kerberos Ticket](/endpoint/windows_computer_account_requesting_kerberos_ticket/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Computer Account With SPN](/endpoint/windows_computer_account_with_spn/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -830,6 +831,7 @@ sidebar: | [Windows Event For Service Disabled](/endpoint/windows_event_for_service_disabled/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Event Log Cleared](/endpoint/windows_event_log_cleared/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Excessive Disabled Services Event](/endpoint/windows_excessive_disabled_services_event/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows Execute Arbitrary Commands with MSDT](/endpoint/windows_execute_arbitrary_commands_with_msdt/) | [Indirect Command Execution](/tags/#indirect-command-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows File Without Extension In Critical Folder](/endpoint/windows_file_without_extension_in_critical_folder/) | [Data Destruction](/tags/#data-destruction) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Get-AdComputer Unconstrained Delegation Discovery](/endpoint/windows_get-adcomputer_unconstrained_delegation_discovery/) | [Remote System Discovery](/tags/#remote-system-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Hidden Schedule Task Settings](/endpoint/windows_hidden_schedule_task_settings/) | [Scheduled Task/Job](/tags/#scheduled-task/job) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -854,6 +856,7 @@ sidebar: | [Windows NirSoft AdvancedRun](/endpoint/windows_nirsoft_advancedrun/) | [Tool](/tags/#tool) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows NirSoft Utilities](/endpoint/windows_nirsoft_utilities/) | [Tool](/tags/#tool) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Non-System Account Targeting Lsass](/endpoint/windows_non-system_account_targeting_lsass/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows Office Product Spawning MSDT](/endpoint/windows_office_product_spawning_msdt/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Possible Credential Dumping](/endpoint/windows_possible_credential_dumping/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows PowerView Constrained Delegation Discovery](/endpoint/windows_powerview_constrained_delegation_discovery/) | [Remote System Discovery](/tags/#remote-system-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows PowerView Unconstrained Delegation Discovery](/endpoint/windows_powerview_unconstrained_delegation_discovery/) | [Remote System Discovery](/tags/#remote-system-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | diff --git a/docs/_pages/stories.md b/docs/_pages/stories.md index 204865e2ab..50a247403a 100644 --- a/docs/_pages/stories.md +++ b/docs/_pages/stories.md @@ -82,6 +82,7 @@ sidebar: | [Masquerading - Rename System Utilities](masquerading_-_rename_system_utilities) | [Rename System Utilities](/tags/#rename-system-utilities), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Masquerading](/tags/#masquerading), [Rundll32](/tags/#rundll32), [Data Destruction](/tags/#data-destruction), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [MSBuild](/tags/#msbuild), [InstallUtil](/tags/#installutil) | [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact) | | [Meterpreter](meterpreter) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Execution](/tags/#execution) | | [Microsoft MSHTML Remote Code Execution CVE-2021-40444](microsoft_mshtml_remote_code_execution_cve-2021-40444) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Control Panel](/tags/#control-panel), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access) | +| [Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190](microsoft_support_diagnostic_tool_vulnerability_cve-2022-30190) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Indirect Command Execution](/tags/#indirect-command-execution), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access) | | [Monitor Backup Solution](monitor_backup_solution) | None | None | | [Monitor for Unauthorized Software](monitor_for_unauthorized_software) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Masquerading](/tags/#masquerading), [OS Credential Dumping](/tags/#os-credential-dumping), [Active Scanning](/tags/#active-scanning) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Reconnaissance](/tags/#reconnaissance) | | [Monitor for Updates](monitor_for_updates) | None | None | @@ -140,7 +141,7 @@ sidebar: | [Web Fraud Detection](web_fraud_detection) | [Create Account](/tags/#create-account), [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [WhisperGate](whispergate) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Data Destruction](/tags/#data-destruction), [Masquerading](/tags/#masquerading), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Virtualization/Sandbox Evasion](/tags/#virtualization/sandbox-evasion), [Time Based Evasion](/tags/#time-based-evasion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Visual Basic](/tags/#visual-basic), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [InstallUtil](/tags/#installutil), [Tool](/tags/#tool), [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe), [Process Injection](/tags/#process-injection), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Resource Development](/tags/#resource-development) | | [Windows DNS SIGRed CVE-2020-1350](windows_dns_sigred_cve-2020-1350) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [Execution](/tags/#execution) | -| [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Compile After Delivery](/tags/#compile-after-delivery), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Modify Registry](/tags/#modify-registry), [Hide Artifacts](/tags/#hide-artifacts), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution) | [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact), [Privilege Escalation](/tags/#privilege-escalation) | +| [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Compile After Delivery](/tags/#compile-after-delivery), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Modify Registry](/tags/#modify-registry), [Hide Artifacts](/tags/#hide-artifacts), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Privilege Escalation](/tags/#privilege-escalation) | | [Windows Discovery Techniques](windows_discovery_techniques) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) | | [Windows Drivers](windows_drivers) | [Rootkit](/tags/#rootkit), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Install Root Certificate](/tags/#install-root-certificate), [Subvert Trust Controls](/tags/#subvert-trust-controls), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Windows File Extension and Association Abuse](windows_file_extension_and_association_abuse) | [Rename System Utilities](/tags/#rename-system-utilities), [Change Default File Association](/tags/#change-default-file-association), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | diff --git a/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md b/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md index d284f074ec..f51059115f 100644 --- a/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md +++ b/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md @@ -106,8 +106,8 @@ The search is used to detect systems that are still vulnerable to the Spectre an #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **spectre_and_meltdown_vulnerable_systems_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md index ec79fde91f..658c53560a 100644 --- a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md +++ b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md @@ -104,8 +104,8 @@ The search queries the authentication logs for assets that are categorized as ro #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_new_login_attempts_to_routers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md index fe4ce2296c..1b3ac7265c 100644 --- a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md +++ b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md @@ -106,8 +106,8 @@ This search looks for Windows endpoints that have not generated an event indicat #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **no_windows_updates_in_a_time_frame_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md index d522844132..6c4980927b 100644 --- a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md +++ b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md @@ -103,8 +103,8 @@ Attackers often use spaces as a means to obfuscate an attachment's file extensio #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **email_attachments_with_lots_of_spaces_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md index 410a212365..76b52316e2 100644 --- a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md @@ -104,8 +104,8 @@ This search looks for specific GET or HEAD requests to web servers that are indi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_attackers_scanning_for_vulnerable_jboss_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md index 421516f284..375df95954 100644 --- a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md @@ -109,8 +109,8 @@ This search is used to detect malicious HTTP requests crafted to exploit jmx-con #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_malicious_requests_to_exploit_jboss_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md index 351df8d65f..9b35c63176 100644 --- a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md @@ -95,9 +95,9 @@ This search looks for DNS requests for faux domains similar to the domains that #### Macros The SPL above uses the following Macros: -* [brand_abuse_dns](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_dns.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [brand_abuse_dns](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_dns.yml) > :information_source: > **monitor_dns_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md index 4457943a64..f06b551e0c 100644 --- a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md @@ -100,9 +100,9 @@ This search looks for Web requests to faux domains similar to the one that you w #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **monitor_web_traffic_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-11-27-detect_usb_device_insertion.md b/docs/_posts/2017-11-27-detect_usb_device_insertion.md index d728677662..6bcf6212ef 100644 --- a/docs/_posts/2017-11-27-detect_usb_device_insertion.md +++ b/docs/_posts/2017-11-27-detect_usb_device_insertion.md @@ -100,8 +100,8 @@ The search is used to detect hosts that generate Windows Event ID 4663 for succe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_usb_device_insertion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md index bfdf6ece90..155282e149 100644 --- a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md +++ b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md @@ -105,8 +105,8 @@ This search looks for emails claiming to be sent from a domain similar to one th #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **monitor_email_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md b/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md index 256ee9687b..5208a6be64 100644 --- a/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md +++ b/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md @@ -110,8 +110,8 @@ This search looks for AWS CloudTrail events where an instance is started in a pa #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **ec2_instance_started_in_previously_unseen_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md b/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md index a7a3e55b1d..3c1752ed2c 100644 --- a/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md +++ b/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md @@ -106,8 +106,8 @@ This search looks for EC2 instances being created with previously unseen AMIs. #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **ec2_instance_started_with_previously_unseen_ami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md b/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md index 5d9fec816d..3bc744ed03 100644 --- a/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md +++ b/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md @@ -117,8 +117,8 @@ This search detects new API calls that have either never been seen before or tha #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **detect_new_api_calls_from_user_roles_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md index bbb21c3187..ba87d130b6 100644 --- a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md +++ b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md @@ -124,8 +124,8 @@ This search will detect users creating spikes in API activity related to securit #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_group_api_calls](https://github.com/splunk/security_content/blob/develop/macros/security_group_api_calls.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **detect_spike_in_security_group_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md b/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md index cfa1600f09..2a13cabd7e 100644 --- a/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md +++ b/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md @@ -101,8 +101,8 @@ This search looks for AWS CloudTrail events where a user logged into the AWS acc #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **detect_api_activity_from_users_without_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md b/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md index c5f5fd575e..7e2378e968 100644 --- a/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md +++ b/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md @@ -122,8 +122,8 @@ This search will detect users creating spikes in API activity related to network #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [network_acl_events](https://github.com/splunk/security_content/blob/develop/macros/network_acl_events.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **detect_spike_in_network_acl_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md index 638971b92a..7ed3679870 100644 --- a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md +++ b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md @@ -110,8 +110,8 @@ This search looks for outbound ICMP packets with a packet size larger than 1,000 #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_large_outbound_icmp_packets_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md index 5604b56488..7ddc9ec68b 100644 --- a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md @@ -114,8 +114,8 @@ This search looks for the creation of WMI permanent event subscriptions. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **wmi_permanent_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md index 71d6f444e4..02ca8ce578 100644 --- a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md @@ -113,8 +113,8 @@ This search looks for the creation of WMI temporary event subscriptions. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **wmi_temporary_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-11-02-windows_hosts_file_modification.md b/docs/_posts/2018-11-02-windows_hosts_file_modification.md index a4d2ecf6d7..7af88de92d 100644 --- a/docs/_posts/2018-11-02-windows_hosts_file_modification.md +++ b/docs/_posts/2018-11-02-windows_hosts_file_modification.md @@ -104,8 +104,8 @@ The search looks for modifications to the hosts file on all Windows endpoints ac #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_hosts_file_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md index cc8964e565..80916277f9 100644 --- a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md +++ b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md @@ -110,9 +110,9 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **remote_wmi_command_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-12-03-usn_journal_deletion.md b/docs/_posts/2018-12-03-usn_journal_deletion.md index c7193842d3..3c7e03fb3e 100644 --- a/docs/_posts/2018-12-03-usn_journal_deletion.md +++ b/docs/_posts/2018-12-03-usn_journal_deletion.md @@ -113,8 +113,8 @@ The fsutil.exe application is a legitimate Windows utility used to perform tasks #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **usn_journal_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-12-06-suspicious_java_classes.md b/docs/_posts/2018-12-06-suspicious_java_classes.md index 3e1d527e90..6fa26f2d66 100644 --- a/docs/_posts/2018-12-06-suspicious_java_classes.md +++ b/docs/_posts/2018-12-06-suspicious_java_classes.md @@ -102,8 +102,8 @@ This search looks for suspicious Java classes that are often used to exploit rem #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_java_classes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-12-14-file_with_samsam_extension.md b/docs/_posts/2018-12-14-file_with_samsam_extension.md index 92a288413c..7fce34dd7a 100644 --- a/docs/_posts/2018-12-14-file_with_samsam_extension.md +++ b/docs/_posts/2018-12-14-file_with_samsam_extension.md @@ -101,8 +101,8 @@ The search looks for file writes with extensions consistent with a SamSam ransom #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **file_with_samsam_extension_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-12-14-samsam_test_file_write.md b/docs/_posts/2018-12-14-samsam_test_file_write.md index 57b1aa725c..99c865c735 100644 --- a/docs/_posts/2018-12-14-samsam_test_file_write.md +++ b/docs/_posts/2018-12-14-samsam_test_file_write.md @@ -107,8 +107,8 @@ The search looks for a file named "test.txt" written to the windows system direc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **samsam_test_file_write_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md b/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md index 47ee78a2f2..dae186beec 100644 --- a/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md +++ b/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md @@ -112,8 +112,8 @@ This search looks for PowerShell requesting privileges consistent with credentia #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_mimikatz_via_powershell_and_eventcode_4703_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md b/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md index 48fbc32d63..22f0bac396 100644 --- a/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md +++ b/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md @@ -107,8 +107,8 @@ The search looks for command-line arguments used to hide a file or directory usi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **reg_exe_used_to_hide_files_directories_via_registry_keys_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md index 36e29731e8..da386816ec 100644 --- a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md +++ b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md @@ -108,8 +108,8 @@ This search looks for suspicious processes on all systems labeled as web servers #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **web_servers_executing_suspicious_processes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-04-25-suspicious_file_write.md b/docs/_posts/2019-04-25-suspicious_file_write.md index dd9f2854a8..16d8353900 100644 --- a/docs/_posts/2019-04-25-suspicious_file_write.md +++ b/docs/_posts/2019-04-25-suspicious_file_write.md @@ -99,9 +99,9 @@ The search looks for files created with names that have been linked to malicious #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_file_write_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md index 903fc504cb..68572ad175 100644 --- a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md +++ b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md @@ -106,8 +106,8 @@ Command lines that are extremely long may be indicative of malicious activity on #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **unusually_long_command_line_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md index 52db687451..438996c3f7 100644 --- a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md +++ b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md @@ -102,9 +102,9 @@ This search looks for applications on the endpoint that you have marked as prohi #### Macros The SPL above uses the following Macros: -* [prohibited_softwares](https://github.com/splunk/security_content/blob/develop/macros/prohibited_softwares.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [prohibited_softwares](https://github.com/splunk/security_content/blob/develop/macros/prohibited_softwares.yml) > :information_source: > **prohibited_software_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-10-creation_of_shadow_copy.md b/docs/_posts/2019-12-10-creation_of_shadow_copy.md index 08da7eedb3..1da58c7e7f 100644 --- a/docs/_posts/2019-12-10-creation_of_shadow_copy.md +++ b/docs/_posts/2019-12-10-creation_of_shadow_copy.md @@ -112,8 +112,8 @@ Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **creation_of_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md index 0634b112b0..0d2319e660 100644 --- a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md +++ b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md @@ -123,8 +123,8 @@ This search allows you to identify DNS requests that are unusually large for the #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **dns_query_length_outliers_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md b/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md index 89f684f87a..68804c7335 100644 --- a/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md +++ b/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md @@ -108,8 +108,8 @@ This search looks for EC2 instances being created with previously unseen instanc #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **ec2_instance_started_with_previously_unseen_instance_type_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md index 39452d1266..950d215c37 100644 --- a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md +++ b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md @@ -102,8 +102,8 @@ This search looks for processes referencing the plist files that determine which #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **macos_-_re-opened_applications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md index 4da5e0416f..9ca9610f1c 100644 --- a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md +++ b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md @@ -113,9 +113,9 @@ Detect the usage of comsvcs.dll for dumping the lsass process. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **dump_lsass_via_comsvcs_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-03-02-remote_registry_key_modifications.md b/docs/_posts/2020-03-02-remote_registry_key_modifications.md index 9182f443c0..31c7141664 100644 --- a/docs/_posts/2020-03-02-remote_registry_key_modifications.md +++ b/docs/_posts/2020-03-02-remote_registry_key_modifications.md @@ -98,8 +98,8 @@ This search monitors for remote modifications to registry keys. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **remote_registry_key_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md index 33c18be258..b0acf6b1a0 100644 --- a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md +++ b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md @@ -116,8 +116,8 @@ This search looks for child processes of spoolsv.exe. This activity is associate #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **child_processes_of_spoolsv_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-03-16-detect_rare_executables.md b/docs/_posts/2020-03-16-detect_rare_executables.md index 49ce545359..db880dad1e 100644 --- a/docs/_posts/2020-03-16-detect_rare_executables.md +++ b/docs/_posts/2020-03-16-detect_rare_executables.md @@ -113,8 +113,8 @@ This search will return a table of rare processes, the names of the systems runn #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml) > :information_source: diff --git a/docs/_posts/2020-03-16-process_execution_via_wmi.md b/docs/_posts/2020-03-16-process_execution_via_wmi.md index ee4bab1330..8b0f895a95 100644 --- a/docs/_posts/2020-03-16-process_execution_via_wmi.md +++ b/docs/_posts/2020-03-16-process_execution_via_wmi.md @@ -110,8 +110,8 @@ The following analytic identifies `WmiPrvSE.exe` spawning a process. This typica #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **process_execution_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-03-16-script_execution_via_wmi.md b/docs/_posts/2020-03-16-script_execution_via_wmi.md index 8cfa6e77a5..8297eac46d 100644 --- a/docs/_posts/2020-03-16-script_execution_via_wmi.md +++ b/docs/_posts/2020-03-16-script_execution_via_wmi.md @@ -110,8 +110,8 @@ This search looks for scripts launched via WMI. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **script_execution_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md index 3937632e2a..fb4a709347 100644 --- a/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md +++ b/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md @@ -102,8 +102,8 @@ This search provides information of unauthenticated requests via user agent, and #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **gcp_kubernetes_cluster_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md index 6314c7448b..4a05b41d21 100644 --- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md +++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md @@ -113,9 +113,9 @@ This search looks for child processes spawned by zoom.exe or zoom.us that has no #### Macros The SPL above uses the following Macros: -* [previously_seen_zoom_child_processes_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_zoom_child_processes_window.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [previously_seen_zoom_child_processes_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_zoom_child_processes_window.yml) > :information_source: > **first_time_seen_child_process_of_zoom_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md index e170e0f832..fca76e2e1c 100644 --- a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md +++ b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md @@ -123,8 +123,8 @@ The detection Detect Path Interception By Creation Of program exe is detecting t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_path_interception_by_creation_of_program_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-06-short_lived_windows_accounts.md b/docs/_posts/2020-07-06-short_lived_windows_accounts.md index 3412fb9342..4e0025dae1 100644 --- a/docs/_posts/2020-07-06-short_lived_windows_accounts.md +++ b/docs/_posts/2020-07-06-short_lived_windows_accounts.md @@ -114,8 +114,8 @@ This search detects accounts that were created and deleted in a short time perio #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **short_lived_windows_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-06-windows_event_log_cleared.md b/docs/_posts/2020-07-06-windows_event_log_cleared.md index 610808a839..e77d0c4535 100644 --- a/docs/_posts/2020-07-06-windows_event_log_cleared.md +++ b/docs/_posts/2020-07-06-windows_event_log_cleared.md @@ -115,9 +115,9 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **windows_event_log_cleared_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md index 545796a26c..c45ef8426b 100644 --- a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md +++ b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md @@ -117,8 +117,8 @@ This search looks for network traffic on TCP/3389, the default port used by remo #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **remote_desktop_network_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-08-detect_new_local_admin_account.md b/docs/_posts/2020-07-08-detect_new_local_admin_account.md index 3e6512d9d8..b14f43e277 100644 --- a/docs/_posts/2020-07-08-detect_new_local_admin_account.md +++ b/docs/_posts/2020-07-08-detect_new_local_admin_account.md @@ -113,8 +113,8 @@ This search looks for newly created accounts that have been elevated to local ad #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_new_local_admin_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md index e63eaaca93..60cfe62adc 100644 --- a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md +++ b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md @@ -118,9 +118,9 @@ This search looks for attempts to stop security-related services on the endpoint #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **attempt_to_stop_security_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md b/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md index 899c3b213b..73fd4e7abe 100644 --- a/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md +++ b/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md @@ -118,8 +118,8 @@ This search looks for successful AWS CloudTrail activity by user accounts that a #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **detect_aws_api_activities_from_unapproved_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md index 7e8954d25d..ca43b07f07 100644 --- a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md +++ b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md @@ -123,13 +123,13 @@ This search looks for DNS requests for phishing domains that are leveraging Evil #### Macros The SPL above uses the following Macros: +* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml) * [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml) * [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml) * [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml) +* [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml) * [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml) -* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml) > :information_source: diff --git a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md index e9fd64eac7..6d646d59fc 100644 --- a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md +++ b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md @@ -119,8 +119,8 @@ This search detects user accounts that have been locked out a relatively high nu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_excessive_user_account_lockouts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md b/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md index 8a71757140..65843532d0 100644 --- a/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md +++ b/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md @@ -115,8 +115,8 @@ This search is used to detect attempts to use DNS tunneling, by calculating the #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_long_dns_txt_record_response_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md b/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md index a7eb0b73a1..8694a6d3a9 100644 --- a/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md +++ b/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md @@ -113,8 +113,8 @@ This search looks for AWS CloudTrail events wherein a console login event by a u #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **detect_new_user_aws_console_login_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md index 0282f5b820..3deacfc3e0 100644 --- a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md +++ b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md @@ -114,8 +114,8 @@ This search looks for outbound SMB connections made by hosts within your network #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_outbound_smb_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md index d8e12c392f..7440974e9a 100644 --- a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md +++ b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md @@ -126,8 +126,8 @@ This search looks for execution of process `outlook.exe` where the process is wr #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_outlook_exe_writing_a_zip_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md index 190ba0c31f..fe3c0f36fd 100644 --- a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md +++ b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md @@ -112,8 +112,8 @@ This search looks for the execution of the cscript.exe or wscript.exe processes, #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_use_of_cmd_exe_to_launch_script_interpreters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md index 499553bcaf..6b95fea6a5 100644 --- a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md +++ b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md @@ -109,9 +109,9 @@ This search looks for web connections to dynamic DNS providers. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_web_traffic_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md index 79bd71b2c0..c83c255d84 100644 --- a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md +++ b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md @@ -110,8 +110,8 @@ This search looks for specific command-line arguments that may indicate the exec #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detection_of_tools_built_by_nirsoft_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md index 5a4f09b92f..be6ba9b32f 100644 --- a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md +++ b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md @@ -118,8 +118,8 @@ This search looks for EC2 instances being modified by users who have not previou #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [ec2_modification_api_calls](https://github.com/splunk/security_content/blob/develop/macros/ec2_modification_api_calls.yml) > :information_source: diff --git a/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md b/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md index f37bf58289..a779faf335 100644 --- a/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md +++ b/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md @@ -117,8 +117,8 @@ This search looks for EC2 instances being created by users who have not created #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **ec2_instance_started_with_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md index 602677cc95..ef311872d0 100644 --- a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md +++ b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md @@ -111,8 +111,8 @@ The search looks at the change-analysis data model and detects email files creat #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **email_files_written_outside_of_the_outlook_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md b/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md index 29a348aab2..c7a48b2c3f 100644 --- a/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md +++ b/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md @@ -126,8 +126,8 @@ This search looks for command-line arguments that use a `/c` parameter to execut #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **first_time_seen_command_line_argument_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md index 3f454963e2..97977c0cfd 100644 --- a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md +++ b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md @@ -118,8 +118,8 @@ This search looks for the first and last time a Windows service is seen running #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [previously_seen_windows_services_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_windows_services_window.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **first_time_seen_running_windows_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md index 9eca0f6f84..e846d6a5a6 100644 --- a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md +++ b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md @@ -111,8 +111,8 @@ Attackers leverage an existing Windows binary, attrib.exe, to mark specific as h #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **hiding_files_and_directories_with_attrib_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md index 9372642573..b997bfa0c1 100644 --- a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md +++ b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md @@ -116,9 +116,9 @@ This search looks for PowerShell processes started with parameters used to bypas #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **malicious_powershell_process_-_execution_policy_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md index 85c2cd05e5..ca52418ecb 100644 --- a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md +++ b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md @@ -119,8 +119,8 @@ This search detects Okta login failures due to bad credentials for multiple user #### Macros The SPL above uses the following Macros: -* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) > :information_source: > **multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md index caa4fab851..6df573f907 100644 --- a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md +++ b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md @@ -117,8 +117,8 @@ Detect failed Okta SSO events #### Macros The SPL above uses the following Macros: -* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) > :information_source: > **okta_failed_sso_attempts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md index 212ff4ee2b..b931e0738d 100644 --- a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md +++ b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md @@ -118,8 +118,8 @@ This search detects logins from the same user from different cities in a 24 hour #### Macros The SPL above uses the following Macros: -* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) > :information_source: > **okta_user_logins_from_multiple_cities_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md index 3d3a23142f..553fd07f28 100644 --- a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md +++ b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md @@ -114,8 +114,8 @@ Microsoft Windows contains accessibility features that can be launched with a ke #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **overwriting_accessibility_binaries_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md index 631e7a941c..d8faab220c 100644 --- a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md +++ b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md @@ -113,8 +113,8 @@ This search looks for network traffic defined by port and transport layer protoc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **prohibited_network_traffic_allowed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md index 2a83d0b689..dc8a715ac8 100644 --- a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md +++ b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md @@ -115,8 +115,8 @@ This search looks for network traffic on common ports where a higher layer proto #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **protocol_or_port_mismatch_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md index 80127df206..b7dc8e4a0e 100644 --- a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md +++ b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md @@ -117,8 +117,8 @@ This search looks for the remote desktop process mstsc.exe running on systems up #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **remote_desktop_process_running_on_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md index c77f07964f..031cb96663 100644 --- a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md +++ b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md @@ -119,8 +119,8 @@ This search looks for arguments to sc.exe indicating the creation or modificatio #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **sc_exe_manipulating_windows_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md b/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md index 1e8576cece..4142da78fc 100644 --- a/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md +++ b/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md @@ -109,8 +109,8 @@ This search looks for flags passed to schtasks.exe on the command-line that indi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **scheduled_tasks_used_in_badrabbit_ransomware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md b/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md index ee8e48bbb9..27a3f80476 100644 --- a/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md +++ b/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md @@ -113,8 +113,8 @@ This search looks for changes to registry values that control Windows file assoc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_changes_to_file_associations_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md b/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md index 8610cdf3c4..97b844b205 100644 --- a/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md +++ b/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md @@ -107,8 +107,8 @@ This detection looks for emails that are suspicious because of their sender, dom #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_email_-_uba_anomaly_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md index 4118197c48..2004b3acf4 100644 --- a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md +++ b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md @@ -117,9 +117,9 @@ This search looks for emails that have attachments with suspicious file extensio #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [suspicious_email_attachments](https://github.com/splunk/security_content/blob/develop/macros/suspicious_email_attachments.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_email_attachment_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md index a04b2b45ac..d7fa94ea7a 100644 --- a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md +++ b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md @@ -114,8 +114,8 @@ This search looks for reg.exe being launched from a command prompt not started b #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_reg_exe_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-tor_traffic.md b/docs/_posts/2020-07-22-tor_traffic.md index f6411060b4..3dd7fb8db4 100644 --- a/docs/_posts/2020-07-22-tor_traffic.md +++ b/docs/_posts/2020-07-22-tor_traffic.md @@ -114,8 +114,8 @@ This search looks for network traffic identified as The Onion Router (TOR), a be #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **tor_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md index 490d46bae2..8bcf280cc2 100644 --- a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md +++ b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md @@ -108,9 +108,9 @@ This search looks for applications on the endpoint that you have marked as uncom #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [uncommon_processes](https://github.com/splunk/security_content/blob/develop/macros/uncommon_processes.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **uncommon_processes_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md b/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md index 3cd964fa66..912002b532 100644 --- a/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md +++ b/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md @@ -112,8 +112,8 @@ Attackers often disable security tools to avoid detection. This search looks for #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **unload_sysmon_filter_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md index 86f9ad6e66..17c0607e42 100644 --- a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md +++ b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md @@ -122,8 +122,8 @@ This search looks for cloud instances being modified by users who have not previ #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **cloud_instance_modified_by_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md b/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md index 7ef5a0acff..5369ba31dd 100644 --- a/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md +++ b/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md @@ -98,8 +98,8 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **cloud_network_access_control_list_deleted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md index 8b02b31f89..4877aed926 100644 --- a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md +++ b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md @@ -113,9 +113,9 @@ This search looks for the creation or deletion of hidden shares using net.exe. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **create_or_delete_windows_shares_using_net_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md index 8afe9011b3..d7016c612e 100644 --- a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md +++ b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md @@ -117,8 +117,8 @@ This search looks for specific authentication events from the Windows Security E #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_activity_related_to_pass_the_hash_attacks_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md index 11f87c2188..a1331265ee 100644 --- a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md +++ b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md @@ -117,8 +117,8 @@ Adversaries may abuse netbooting to load an unauthorized network device operatin #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_software_download_to_network_device_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-06-ryuk_test_files_detected.md b/docs/_posts/2020-11-06-ryuk_test_files_detected.md index 0d1c5cff53..d041187349 100644 --- a/docs/_posts/2020-11-06-ryuk_test_files_detected.md +++ b/docs/_posts/2020-11-06-ryuk_test_files_detected.md @@ -106,8 +106,8 @@ The search looks for files that contain the key word *Ryuk* under any folder in #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **ryuk_test_files_detected_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md b/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md index aad62e03e2..b82ace11fb 100644 --- a/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md +++ b/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md @@ -106,8 +106,8 @@ The search looks for the Console Window Host process (connhost.exe) executed usi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_connhost_exe_started_forcefully_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md index 455f8b1e96..fbe87c02b9 100644 --- a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md +++ b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md @@ -106,8 +106,8 @@ The search looks for a Windows Security Account Manager (SAM) was stopped via co #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_security_account_manager_stopped_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-09-common_ransomware_extensions.md b/docs/_posts/2020-11-09-common_ransomware_extensions.md index dc37dca253..16f8f2ce59 100644 --- a/docs/_posts/2020-11-09-common_ransomware_extensions.md +++ b/docs/_posts/2020-11-09-common_ransomware_extensions.md @@ -109,9 +109,9 @@ The search looks for file modifications with extensions commonly used by Ransomw #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [ransomware_extensions](https://github.com/splunk/security_content/blob/develop/macros/ransomware_extensions.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **common_ransomware_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-09-common_ransomware_notes.md b/docs/_posts/2020-11-09-common_ransomware_notes.md index 315432c79b..fcae1b501f 100644 --- a/docs/_posts/2020-11-09-common_ransomware_notes.md +++ b/docs/_posts/2020-11-09-common_ransomware_notes.md @@ -108,9 +108,9 @@ The search looks for files created with names matching those typically used in r #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [ransomware_notes](https://github.com/splunk/security_content/blob/develop/macros/ransomware_notes.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **common_ransomware_notes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-09-deleting_shadow_copies.md b/docs/_posts/2020-11-09-deleting_shadow_copies.md index f6b57fe6ab..5220a7a914 100644 --- a/docs/_posts/2020-11-09-deleting_shadow_copies.md +++ b/docs/_posts/2020-11-09-deleting_shadow_copies.md @@ -109,8 +109,8 @@ The vssadmin.exe utility is used to interact with the Volume Shadow Copy Service #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **deleting_shadow_copies_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md index 2deda244e4..a66f50336a 100644 --- a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md +++ b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md @@ -119,8 +119,8 @@ This search identifies endpoints that have caused a relatively high number of ac #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_excessive_account_lockouts_from_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md index 151a1b664f..5bfea4bfef 100644 --- a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md +++ b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md @@ -113,9 +113,9 @@ This search looks for fast execution of processes used for system network config #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [system_network_configuration_discovery_tools](https://github.com/splunk/security_content/blob/develop/macros/system_network_configuration_discovery_tools.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_processes_used_for_system_network_configuration_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md index fe972a76d4..1653748824 100644 --- a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md +++ b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md @@ -113,9 +113,9 @@ This search looks for executions of cmd.exe spawned by a process that is often a #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml) > :information_source: diff --git a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md index 83b2b703c9..a635804329 100644 --- a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md +++ b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md @@ -114,8 +114,8 @@ This search looks for processes launched from files that have double extensions #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **execution_of_file_with_multiple_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md b/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md index 5850ce8104..55390d3e19 100644 --- a/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md +++ b/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md @@ -109,8 +109,8 @@ This search looks for processes launched from files with at least five spaces in #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **execution_of_file_with_spaces_before_extension_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-23-processes_created_by_netsh.md b/docs/_posts/2020-11-23-processes_created_by_netsh.md index 7b7f79645c..4f822f395c 100644 --- a/docs/_posts/2020-11-23-processes_created_by_netsh.md +++ b/docs/_posts/2020-11-23-processes_created_by_netsh.md @@ -107,8 +107,8 @@ This search looks for processes launching netsh.exe to execute various commands #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **processes_created_by_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md index e2c9aaaf5c..4b7da73120 100644 --- a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md +++ b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md @@ -113,8 +113,8 @@ This search detects the process execution and arguments required to silently cre #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **shim_database_installation_with_suspicious_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md index 14d83a388f..3ae13aaa91 100644 --- a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md +++ b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md @@ -121,8 +121,8 @@ The search looks for reg.exe modifying registry keys that define Windows service #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **reg_exe_manipulating_windows_services_registry_keys_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md index bf5a4d23b9..a491d093cf 100644 --- a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md +++ b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md @@ -115,8 +115,8 @@ This search looks for flags passed to schtasks.exe on the command-line that indi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **schtasks_used_for_forcing_a_reboot_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-08-shim_database_file_creation.md b/docs/_posts/2020-12-08-shim_database_file_creation.md index 0ce6a8a469..3c3b4afebb 100644 --- a/docs/_posts/2020-12-08-shim_database_file_creation.md +++ b/docs/_posts/2020-12-08-shim_database_file_creation.md @@ -112,8 +112,8 @@ This search looks for shim database files being written to default directories. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **shim_database_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md index 545bc9c5ad..1f18944d0c 100644 --- a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md +++ b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md @@ -115,8 +115,8 @@ This search looks for process names that consist only of a single letter. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **single_letter_process_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md index 6f18cf8b5a..e6918240a1 100644 --- a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md +++ b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md @@ -115,9 +115,9 @@ During triage, review the parallel processes - what process moved the native Win #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [is_windows_system_file](https://github.com/splunk/security_content/blob/develop/macros/is_windows_system_file.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **system_processes_run_from_unexpected_locations_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-08-unusually_long_command_line.md b/docs/_posts/2020-12-08-unusually_long_command_line.md index a6874e39d2..4bca43b17b 100644 --- a/docs/_posts/2020-12-08-unusually_long_command_line.md +++ b/docs/_posts/2020-12-08-unusually_long_command_line.md @@ -105,8 +105,8 @@ Command lines that are extremely long may be indicative of malicious activity on #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **unusually_long_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md b/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md index ee30a723f2..8857789a74 100644 --- a/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md +++ b/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md @@ -113,8 +113,8 @@ This search detects the assignment of rights to accesss content from another mai #### Macros The SPL above uses the following Macros: -* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) > :information_source: > **o365_suspicious_rights_delegation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-16-o365_pst_export_alert.md b/docs/_posts/2020-12-16-o365_pst_export_alert.md index 4037093153..972953b60e 100644 --- a/docs/_posts/2020-12-16-o365_pst_export_alert.md +++ b/docs/_posts/2020-12-16-o365_pst_export_alert.md @@ -100,8 +100,8 @@ This search detects when a user has performed an Ediscovery search or exported a #### Macros The SPL above uses the following Macros: -* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) > :information_source: > **o365_pst_export_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md b/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md index 24a14ff406..15bbb80cd2 100644 --- a/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md +++ b/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md @@ -114,8 +114,8 @@ This search detects when an admin configured a forwarding rule for multiple mail #### Macros The SPL above uses the following Macros: -* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) > :information_source: > **o365_suspicious_admin_email_forwarding_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md b/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md index 46ed9198f8..a6fd025871 100644 --- a/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md +++ b/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md @@ -114,8 +114,8 @@ This search detects when multiple user configured a forwarding rule to the same #### Macros The SPL above uses the following Macros: -* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) > :information_source: > **o365_suspicious_user_email_forwarding_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md index 9a0522dffa..cbaa2a7114 100644 --- a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md +++ b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md @@ -106,8 +106,8 @@ This search looks for flags passed to bcdedit.exe modifications to the built-in #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **bcdedit_failure_recovery_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md index 7e569728b0..a3cca683c2 100644 --- a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md +++ b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md @@ -107,8 +107,8 @@ This search provides detection of KMS keys where action kms:Encrypt is accessibl #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md index 94ca9fd7d9..c0a423f76c 100644 --- a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md +++ b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md @@ -101,8 +101,8 @@ This search provides detection of users with KMS keys performing encryption spec #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **aws_detect_users_with_kms_keys_performing_encryption_s3_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md index 9c6b89bff6..738b9292e8 100644 --- a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md +++ b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md @@ -114,8 +114,8 @@ The search looks for AWS CloudTrail events to detect if any network ACLs were cr #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **aws_network_access_control_list_created_with_all_open_ports_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md index 97fe890be8..338cc3e6db 100644 --- a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md +++ b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md @@ -111,8 +111,8 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **aws_network_access_control_list_deleted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md index 56ad8afeab..c83bf0da91 100644 --- a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md +++ b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md @@ -107,9 +107,9 @@ The following analytic identifies microsoft.workflow.compiler.exe usage. microso #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_microsoft_workflow_compiler_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md index 980b6c1ff8..be49ceb327 100644 --- a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md +++ b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md @@ -112,9 +112,9 @@ The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavi #### Macros The SPL above uses the following Macros: -* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) > :information_source: > **suspicious_msbuild_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md index f837ac19d1..62ab0f3d32 100644 --- a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md +++ b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md @@ -112,8 +112,8 @@ The following analytic identifies child processes spawning from "mshta.exe". Th #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_mshta_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md index f3ff99120f..625ce535e6 100644 --- a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md +++ b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md @@ -112,9 +112,9 @@ Malicious actors often abuse legitimate Dynamic DNS services to host malicious p #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [dynamic_dns_providers](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_providers.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_hosts_connecting_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md index d264511cc0..c5775eb74a 100644 --- a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md +++ b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md @@ -118,9 +118,9 @@ This search looks for PowerShell processes launched with arguments that have cha #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **malicious_powershell_process_with_obfuscation_techniques_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md b/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md index f48bcf3d8c..da3b0bca32 100644 --- a/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md +++ b/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md @@ -112,8 +112,8 @@ This search looks for PowerShell processes started with a base64 encoded command #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_powershell_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md index 3c942c3b56..6099e8c675 100644 --- a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md +++ b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md @@ -112,9 +112,9 @@ The following analytic identifies "rundll32.exe" execution with inline protocol #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_rundll32_inline_hta_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md index 80f40c2548..8c9e4e8eab 100644 --- a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md +++ b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md @@ -112,9 +112,9 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_mshta_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md index 1a8acc8dc0..adb6f92ec6 100644 --- a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md +++ b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md @@ -106,8 +106,8 @@ This search looks for flags passed to wbadmin.exe (Windows Backup Administrator #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **wbadmin_delete_system_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md index 11ca52df26..12f23188b9 100644 --- a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md +++ b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md @@ -103,8 +103,8 @@ This search provides specific SAML access from specific Service Provider, user a #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **aws_saml_access_by_provider_user_and_principal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md index 0573301025..bcdfd070a6 100644 --- a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md +++ b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md @@ -103,8 +103,8 @@ This search provides detection of updates to SAML provider in AWS. Updates to SA #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **aws_saml_update_identity_provider_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md b/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md index 86e33ba13c..ec35fb3d93 100644 --- a/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md +++ b/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md @@ -93,8 +93,8 @@ This search looks for arguments to certutil.exe indicating the manipulation or e #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **certutil_exe_certificate_extraction_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md b/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md index d743ca3df3..b7e7dfbb01 100644 --- a/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md +++ b/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md @@ -105,8 +105,8 @@ This search detects the creation of a new Federation setting by alerting about a #### Macros The SPL above uses the following Macros: -* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) > :information_source: > **o365_add_app_role_assignment_grant_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md b/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md index d5a0cd0982..27ebda9129 100644 --- a/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md +++ b/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md @@ -103,8 +103,8 @@ This search detects accounts with high number of Single Sign ON (SSO) logon erro #### Macros The SPL above uses the following Macros: -* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) > :information_source: > **o365_excessive_sso_logon_errors_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-26-o365_new_federated_domain_added.md b/docs/_posts/2021-01-26-o365_new_federated_domain_added.md index 5c5fd9416e..789547b9a3 100644 --- a/docs/_posts/2021-01-26-o365_new_federated_domain_added.md +++ b/docs/_posts/2021-01-26-o365_new_federated_domain_added.md @@ -105,8 +105,8 @@ This search detects the addition of a new Federated domain. #### Macros The SPL above uses the following Macros: -* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) > :information_source: > **o365_new_federated_domain_added_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md index c02bb291a8..dda50e0817 100644 --- a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md +++ b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md @@ -114,8 +114,8 @@ This technique uses "Install from Media" (IFM), which will extract a copy of the #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **ntdsutil_export_ntds_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md index 106fba2a3a..75dc50ffee 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md @@ -112,9 +112,9 @@ The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_rundll32_application_control_bypass_-_advpack_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md index 1cda0b345e..3e6588b4f0 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md @@ -112,9 +112,9 @@ The following analytic identifies rundll32.exe loading setupapi.dll and iesetupa #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_rundll32_application_control_bypass_-_setupapi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md index ad8bac5f78..742b5c98c6 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md @@ -112,9 +112,9 @@ The following analytic identifies rundll32.exe loading syssetup.dll by calling t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_rundll32_application_control_bypass_-_syssetup_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md index 062103101d..9381724d97 100644 --- a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md +++ b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md @@ -112,9 +112,9 @@ The following analytic identifies rundll32.exe executing a DLL function name, St #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_rundll32_startw_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md index 32fe627370..292a669702 100644 --- a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md +++ b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md @@ -112,9 +112,9 @@ The following analytic identifies rundll32.exe using dllregisterserver on the co #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_rundll32_dllregisterserver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md index 3b86e6e0d0..c0b4bc7a67 100644 --- a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md +++ b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md @@ -112,8 +112,8 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_html_help_spawn_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md index f85e76b088..cd7ca3972f 100644 --- a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md +++ b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md @@ -112,8 +112,8 @@ The following analytic identifies regasm.exe spawning a process. This particular #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_regasm_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md index 078a873546..762ef51bb9 100644 --- a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md +++ b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md @@ -112,8 +112,8 @@ The following analytic identifies regsvcs.exe spawning a process. This particula #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_regsvcs_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md index e25de67624..30f9a2acf5 100644 --- a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md +++ b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md @@ -104,8 +104,8 @@ The following analytic identifies the use of a curl contacting suspicious remote #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_curl_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md index 5e9fb637c6..428f6b8d56 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md @@ -118,8 +118,8 @@ Upon triage, capture the property list file being written to disk and review for #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_plistbuddy_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md index 2fcfb82b2f..b245612546 100644 --- a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md +++ b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md @@ -104,8 +104,8 @@ The following analytic identifies the use of a SQLite3 querying the MacOS prefer #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_sqlite3_lsquarantine_behavior_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md index 4fca2c5b1d..88aedeb6ce 100644 --- a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md +++ b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md @@ -118,8 +118,8 @@ Upon triage, fodhelper.exe will have a child process and read access will occur #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **fodhelper_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md index 9050ba0148..607c8d3cf4 100644 --- a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md +++ b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md @@ -107,8 +107,8 @@ This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **ryuk_wake_on_lan_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md index 0a2f0ff5d4..f036563722 100644 --- a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md +++ b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md @@ -111,8 +111,8 @@ The following detection identifies Scheduled Tasks registering (creating a new t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_scheduled_task_from_public_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md index 55f6c7f4ae..463e0af419 100644 --- a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md +++ b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md @@ -117,8 +117,8 @@ This search looks for AWS CloudTrail events where a user has set a default polic #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **aws_setdefaultpolicyversion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md index b68b16519d..ac24cff45e 100644 --- a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md +++ b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md @@ -107,8 +107,8 @@ This detection identifies Microsoft Exchange Server's Unified Messaging services #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **unified_messaging_service_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md index f86c4ee224..171845712b 100644 --- a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md +++ b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md @@ -112,8 +112,8 @@ The search looks for the Registry Key DisableAntiSpyware set to disable. This is #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_disableantispyware_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md index 082d8597ae..ca2f4ac480 100644 --- a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md +++ b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md @@ -107,9 +107,9 @@ This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **nishang_powershelltcponeline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-03-w3wp_spawning_shell.md b/docs/_posts/2021-03-03-w3wp_spawning_shell.md index c476e2761e..d92ee514cf 100644 --- a/docs/_posts/2021-03-03-w3wp_spawning_shell.md +++ b/docs/_posts/2021-03-03-w3wp_spawning_shell.md @@ -116,10 +116,10 @@ This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **w3wp_spawning_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md index d06ace054c..8c9f90e057 100644 --- a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md +++ b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md @@ -102,8 +102,8 @@ The following analytics identifies the resizing of shadowstorage by ransomware m #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **resize_shadowstorage_volume_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-17-clop_common_exec_parameter.md b/docs/_posts/2021-03-17-clop_common_exec_parameter.md index 071a22bdd3..a5a8ca1fac 100644 --- a/docs/_posts/2021-03-17-clop_common_exec_parameter.md +++ b/docs/_posts/2021-03-17-clop_common_exec_parameter.md @@ -102,8 +102,8 @@ The following analytics are designed to identifies some CLOP ransomware variant #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **clop_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md index 0b7fdfe081..20649a78c8 100644 --- a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md +++ b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md @@ -102,8 +102,8 @@ This detection is to identify the common service name created by the CLOP ransom #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **clop_ransomware_known_service_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-23-certutil_with_decode_argument.md b/docs/_posts/2021-03-23-certutil_with_decode_argument.md index e492729dbd..4e2db07e22 100644 --- a/docs/_posts/2021-03-23-certutil_with_decode_argument.md +++ b/docs/_posts/2021-03-23-certutil_with_decode_argument.md @@ -102,9 +102,9 @@ CertUtil.exe may be used to `encode` and `decode` a file, including PE and scrip #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **certutil_with_decode_argument_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md index 5583fced4f..e540c62069 100644 --- a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md +++ b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md @@ -103,9 +103,9 @@ Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functio #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_start-bitstransfer_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md index 58cc4bc2de..c36f3c3426 100644 --- a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md +++ b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md @@ -110,8 +110,8 @@ The following query uses IAM events to track the success of a group being delete #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **aws_iam_successful_group_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md index 50c84abe94..01095298e1 100644 --- a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md +++ b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md @@ -107,9 +107,9 @@ This search is to identifies suspicious firewall disabling using netsh applicati #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **disabling_firewall_with_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-31-dsquery_domain_discovery.md b/docs/_posts/2021-03-31-dsquery_domain_discovery.md index 5d78235363..5da293842c 100644 --- a/docs/_posts/2021-03-31-dsquery_domain_discovery.md +++ b/docs/_posts/2021-03-31-dsquery_domain_discovery.md @@ -107,8 +107,8 @@ In addition to trust discovery, review parallel processes for additional behavio #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **dsquery_domain_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md index eefad1135a..fe9f994097 100644 --- a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md +++ b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md @@ -106,8 +106,8 @@ The following detection identifies any malformed policy document exceptions with #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **aws_iam_assume_role_policy_brute_force_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-01-aws_iam_delete_policy.md b/docs/_posts/2021-04-01-aws_iam_delete_policy.md index d6f1902252..4a24129392 100644 --- a/docs/_posts/2021-04-01-aws_iam_delete_policy.md +++ b/docs/_posts/2021-04-01-aws_iam_delete_policy.md @@ -100,8 +100,8 @@ The following detection identifes when a policy is deleted on AWS. This does not #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **aws_iam_delete_policy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md index e260cd7bb3..213ebb88ad 100644 --- a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md +++ b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md @@ -100,8 +100,8 @@ This detection identifies failure attempts to delete groups. We want to identify #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **aws_iam_failure_group_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md index ab261f4d7d..ebd16db17c 100644 --- a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md +++ b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md @@ -115,8 +115,8 @@ This detection is to identify the abuse the Windows SC.exe to execute malicious #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **malicious_powershell_executed_as_a_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md index 6809b34a14..8298ca7fc7 100644 --- a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md +++ b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md @@ -115,8 +115,8 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or was it v #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **winevent_scheduled_task_created_within_public_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-12-excel_spawning_powershell.md b/docs/_posts/2021-04-12-excel_spawning_powershell.md index a7a8420e93..827d3d903e 100644 --- a/docs/_posts/2021-04-12-excel_spawning_powershell.md +++ b/docs/_posts/2021-04-12-excel_spawning_powershell.md @@ -107,9 +107,9 @@ The following detection identifies Microsoft Excel spawning PowerShell. Typicall #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **excel_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md index 881449035a..97711642bd 100644 --- a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md +++ b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md @@ -107,8 +107,8 @@ The following detection identifies Microsoft Excel spawning Windows Script Host #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **excel_spawning_windows_script_host_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md index fa288d86e1..5ff4bdb821 100644 --- a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md +++ b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md @@ -115,8 +115,8 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or via Task #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **winevent_scheduled_task_created_to_spawn_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-12-winword_spawning_powershell.md b/docs/_posts/2021-04-12-winword_spawning_powershell.md index 89a771922f..182f4dafbf 100644 --- a/docs/_posts/2021-04-12-winword_spawning_powershell.md +++ b/docs/_posts/2021-04-12-winword_spawning_powershell.md @@ -107,9 +107,9 @@ The following detection identifies Microsoft Word spawning PowerShell. Typically #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **winword_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md index e7b23e671b..fb285a2aab 100644 --- a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md +++ b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md @@ -107,8 +107,8 @@ The following detection identifies Microsoft Winword.exe spawning Windows Script #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **winword_spawning_windows_script_host_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md index 630da0dd3c..af0757675b 100644 --- a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md +++ b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md @@ -107,8 +107,8 @@ This search looks for AWS CloudTrail events and analyse the amount of eventNames #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **aws_excessive_security_scanning_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md index c8dc27db62..255a986595 100644 --- a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md +++ b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md @@ -107,9 +107,9 @@ this detection was designed to identifies suspicious spawned process of known MS #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **office_application_spawn_rundll32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md index b318ba8cc3..cabd59cc6b 100644 --- a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md +++ b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md @@ -102,8 +102,8 @@ this search is to detect potential DNS exfiltration using nslookup application. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **dns_exfiltration_using_nslookup_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md index 3518e5e547..b297562c89 100644 --- a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md +++ b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md @@ -105,8 +105,8 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **schedule_task_with_http_command_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md index 323536440f..80da349bf8 100644 --- a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md +++ b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md @@ -105,8 +105,8 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **schedule_task_with_rundll32_command_trigger_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md index 64a581ee32..6af6b73b14 100644 --- a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md +++ b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md @@ -102,10 +102,10 @@ This search is designed to detect suspicious cmd and powershell process spawned #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **wermgr_process_spawned_cmd_or_powershell_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md index f787b8f414..ec93fceb92 100644 --- a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md +++ b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md @@ -109,8 +109,8 @@ This search is designed to detect high frequency of archive files data exfiltrat #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **multiple_archive_files_http_post_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md index 7d58b841d5..730593c05b 100644 --- a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md +++ b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md @@ -107,8 +107,8 @@ The following detection identifies a 7z.exe spawned from `Rundll32.exe` or `Dllh #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **anomalous_usage_of_7zip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md index fd3e25319c..a78bcf13c0 100644 --- a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md +++ b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md @@ -107,9 +107,9 @@ The following detection identifies the latest behavior utilized by IcedID malwar #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **office_product_spawning_rundll32_with_no_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md index 2f4662d6e8..8b9810d35a 100644 --- a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md +++ b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md @@ -106,8 +106,8 @@ This search is to detect potential plain HTTP POST method data exfiltration. Thi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **plain_http_post_exfiltrated_data_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-22-winword_spawning_cmd.md b/docs/_posts/2021-04-22-winword_spawning_cmd.md index cd8bc91dff..eb76a29dcb 100644 --- a/docs/_posts/2021-04-22-winword_spawning_cmd.md +++ b/docs/_posts/2021-04-22-winword_spawning_cmd.md @@ -107,9 +107,9 @@ The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **winword_spawning_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md index 83ac9784e0..aff2d794c5 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md +++ b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md @@ -107,9 +107,9 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **office_product_spawning_bitsadmin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-26-office_product_spawning_certutil.md b/docs/_posts/2021-04-26-office_product_spawning_certutil.md index a6c6750967..f488fe6b17 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_certutil.md +++ b/docs/_posts/2021-04-26-office_product_spawning_certutil.md @@ -107,9 +107,9 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **office_product_spawning_certutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-26-office_product_spawning_mshta.md b/docs/_posts/2021-04-26-office_product_spawning_mshta.md index e1e4038175..928f33d95d 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_mshta.md +++ b/docs/_posts/2021-04-26-office_product_spawning_mshta.md @@ -107,9 +107,9 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **office_product_spawning_mshta_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-29-icacls_deny_command.md b/docs/_posts/2021-04-29-icacls_deny_command.md index 4eae75a7fe..0564a725e3 100644 --- a/docs/_posts/2021-04-29-icacls_deny_command.md +++ b/docs/_posts/2021-04-29-icacls_deny_command.md @@ -102,8 +102,8 @@ This analytic identifies a potential adversary that changes the security permiss #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **icacls_deny_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-deleting_of_net_users.md b/docs/_posts/2021-05-04-deleting_of_net_users.md index 2d513333bd..0c14ba885d 100644 --- a/docs/_posts/2021-05-04-deleting_of_net_users.md +++ b/docs/_posts/2021-05-04-deleting_of_net_users.md @@ -102,9 +102,9 @@ This analytic will detect a suspicious net.exe/net1.exe command-line to delete a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **deleting_of_net_users_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-disabling_net_user_account.md b/docs/_posts/2021-05-04-disabling_net_user_account.md index 5d3c6378ba..527779eb86 100644 --- a/docs/_posts/2021-05-04-disabling_net_user_account.md +++ b/docs/_posts/2021-05-04-disabling_net_user_account.md @@ -102,9 +102,9 @@ This analytic will identify a suspicious command-line that disables a user accou #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **disabling_net_user_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md index b09ec6c2e0..a0299d74cd 100644 --- a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md +++ b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md @@ -103,8 +103,8 @@ This analytic will identify suspicious series of command-line to disable several #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **excessive_attempt_to_disable_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md index 3dec5b2e36..dd85acd186 100644 --- a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md +++ b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md @@ -103,9 +103,9 @@ This analytic identifies suspicious series of attempt to kill multiple services #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **excessive_service_stop_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md index 58d25495b2..6f39ebd87d 100644 --- a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md +++ b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md @@ -108,8 +108,8 @@ This analytic identifies excessive usage of `taskkill.exe` application. This app #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **excessive_usage_of_taskkill_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-icacls_grant_command.md b/docs/_posts/2021-05-04-icacls_grant_command.md index 01c62fcfba..eb7ba0395c 100644 --- a/docs/_posts/2021-05-04-icacls_grant_command.md +++ b/docs/_posts/2021-05-04-icacls_grant_command.md @@ -102,8 +102,8 @@ This analytic identifies potential adversaries that modify the security permissi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **icacls_grant_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md index bbecb9975f..2c38baa934 100644 --- a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md +++ b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md @@ -107,9 +107,9 @@ The following analytic identifies the use of `wmic.exe` using `delete` to remove #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **process_kill_base_on_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-05-suspicious_process_file_path.md b/docs/_posts/2021-05-05-suspicious_process_file_path.md index aea34adffa..20defc4a27 100644 --- a/docs/_posts/2021-05-05-suspicious_process_file_path.md +++ b/docs/_posts/2021-05-05-suspicious_process_file_path.md @@ -103,8 +103,8 @@ The following analytic will detect a suspicious process running in a file path w #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_process_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md index 04879af5f4..2283e7d33e 100644 --- a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md +++ b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md @@ -101,8 +101,8 @@ This analytic will detect a suspicious Telegram process enumerating all network #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **enumerate_users_local_group_using_telegram_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md index 2b90be4869..bc21e21b96 100644 --- a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md +++ b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md @@ -103,9 +103,9 @@ This analytic identifies excessive usage of `net.exe` or `net1.exe` within a buc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **excessive_usage_of_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md index 349ae29be9..f92d154dec 100644 --- a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md +++ b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md @@ -102,8 +102,8 @@ This analytic will identify suspicious executable or scripts (known file extensi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **executables_or_script_creation_in_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md index 7a6bc74726..90fde55d8b 100644 --- a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md +++ b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md @@ -103,8 +103,8 @@ The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe` o #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **excessive_usage_of_cacls_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md index 9e8d148a76..d63ea1659d 100644 --- a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md +++ b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md @@ -104,8 +104,8 @@ This analytic identifies an on demand run of a Windows Schedule Task through she #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **schtasks_run_task_on_demand_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md b/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md index cdb6bd5506..b1bcc55565 100644 --- a/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md +++ b/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md @@ -101,8 +101,8 @@ This following analytic detects PowerShell command to delete shadow copy using t #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **delete_shadowcopy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-13-slui_runas_elevated.md b/docs/_posts/2021-05-13-slui_runas_elevated.md index 6f128776c8..a1835dbf5b 100644 --- a/docs/_posts/2021-05-13-slui_runas_elevated.md +++ b/docs/_posts/2021-05-13-slui_runas_elevated.md @@ -109,8 +109,8 @@ The following analytic identifies the Microsoft Software Licensing User Interfac #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **slui_runas_elevated_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-13-slui_spawning_a_process.md b/docs/_posts/2021-05-13-slui_spawning_a_process.md index ec237144a1..34b893e943 100644 --- a/docs/_posts/2021-05-13-slui_spawning_a_process.md +++ b/docs/_posts/2021-05-13-slui_spawning_a_process.md @@ -109,8 +109,8 @@ The following analytic identifies the Microsoft Software Licensing User Interfac #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **slui_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-18-services_escalate_exe.md b/docs/_posts/2021-05-18-services_escalate_exe.md index 47924bf50c..f6b26aed3e 100644 --- a/docs/_posts/2021-05-18-services_escalate_exe.md +++ b/docs/_posts/2021-05-18-services_escalate_exe.md @@ -103,8 +103,8 @@ The following analytic identifies the use of `svc-exe` with Cobalt Strike. The b #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **services_escalate_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md b/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md index f8d18f858e..9f0639ec6f 100644 --- a/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md +++ b/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md @@ -106,8 +106,8 @@ The following analytic identifies suspicious PowerShell command to allow inbound #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **allow_inbound_traffic_in_firewall_rule_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-19-mailsniper_invoke_functions.md b/docs/_posts/2021-05-19-mailsniper_invoke_functions.md index e5e1267fc9..4ea231a206 100644 --- a/docs/_posts/2021-05-19-mailsniper_invoke_functions.md +++ b/docs/_posts/2021-05-19-mailsniper_invoke_functions.md @@ -106,8 +106,8 @@ This search is to detect known mailsniper.ps1 functions executed in a machine. T #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **mailsniper_invoke_functions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md index c32f863108..38b96a46ec 100644 --- a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md +++ b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md @@ -119,9 +119,9 @@ This analytic identifies a common behavior by Cobalt Strike and other frameworks #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **cmd_echo_pipe_-_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-21-winrm_spawning_a_process.md b/docs/_posts/2021-05-21-winrm_spawning_a_process.md index f941292f1b..2f887bf9b1 100644 --- a/docs/_posts/2021-05-21-winrm_spawning_a_process.md +++ b/docs/_posts/2021-05-21-winrm_spawning_a_process.md @@ -110,8 +110,8 @@ The following analytic identifies suspicious processes spawning from WinRM (wsmp #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **winrm_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md index 42ee811fe0..a21d072f69 100644 --- a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md +++ b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md @@ -107,8 +107,8 @@ This analytic detects a potential usage of secretsdump.py tool for dumping crede #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **secretdumps_offline_ntds_dumping_tool_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md index f6da8244e1..41ab2d83b9 100644 --- a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md +++ b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md @@ -132,8 +132,8 @@ SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. Shar #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_sharphound_file_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-27-detect_sharphound_usage.md b/docs/_posts/2021-05-27-detect_sharphound_usage.md index 3fe7723c86..152ca345eb 100644 --- a/docs/_posts/2021-05-27-detect_sharphound_usage.md +++ b/docs/_posts/2021-05-27-detect_sharphound_usage.md @@ -132,8 +132,8 @@ The following analytic identifies SharpHound binary usage by using the original #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_sharphound_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md index 93e1e6b5cc..ff48516595 100644 --- a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md +++ b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md @@ -132,8 +132,8 @@ The following analytic identifies the common command-line argument used by Azure #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_azurehound_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md index b9c6d7610e..4b312b53f1 100644 --- a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md +++ b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md @@ -132,8 +132,8 @@ The following analytic is similar to SharpHound file modifications, but this ins #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_azurehound_file_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md index efc68eb9c4..5b0437505b 100644 --- a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md +++ b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md @@ -132,8 +132,8 @@ The following analytic identifies common command-line arguments used by SharpHou #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_sharphound_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-02-conti_common_exec_parameter.md b/docs/_posts/2021-06-02-conti_common_exec_parameter.md index 316ee41a9b..9167d33ce5 100644 --- a/docs/_posts/2021-06-02-conti_common_exec_parameter.md +++ b/docs/_posts/2021-06-02-conti_common_exec_parameter.md @@ -102,8 +102,8 @@ This search detects the suspicious commandline argument of revil ransomware to e #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **conti_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-02-revil_common_exec_parameter.md b/docs/_posts/2021-06-02-revil_common_exec_parameter.md index 333cfb289a..3a23505f10 100644 --- a/docs/_posts/2021-06-02-revil_common_exec_parameter.md +++ b/docs/_posts/2021-06-02-revil_common_exec_parameter.md @@ -102,8 +102,8 @@ This analytic identifies suspicious commandline parameter that are commonly used #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **revil_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md index 3c01acc3b9..e87879902a 100644 --- a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md +++ b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md @@ -101,8 +101,8 @@ This search detects a suspicioous termination of known services killed by ransom #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **known_services_killed_by_ransomware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md index 21bfada3a3..78a645abb8 100644 --- a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md +++ b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md @@ -107,8 +107,8 @@ This detection targets behaviors observed in post exploit kits like Meterpreter #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **excessive_number_of_taskhost_processes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md b/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md index 98ba72fb42..9ee956342a 100644 --- a/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md +++ b/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md @@ -114,8 +114,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_fileless_process_injection_via_getprocaddress_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md b/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md index c538fe2b26..0dd71e0692 100644 --- a/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md +++ b/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md @@ -113,8 +113,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_fileless_script_contains_base64_encoded_content_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md b/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md index fa15056f8b..937137c5c5 100644 --- a/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md +++ b/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md @@ -107,8 +107,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **detect_empire_with_powershell_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md b/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md index b7dc1c284f..9cdd30b4b4 100644 --- a/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md +++ b/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md @@ -102,8 +102,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **detect_mimikatz_with_powershell_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md index 793f8550d3..6951933b36 100644 --- a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md +++ b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md @@ -112,8 +112,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **unloading_amsi_via_reflection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md index 262e1b6bf6..6961249843 100644 --- a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md +++ b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md @@ -107,8 +107,8 @@ this search is to detect execution of `cipher.exe` to clear the unallocated sect #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **clear_unallocated_sector_using_cipher_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md index 0ea696d65d..0a14d81719 100644 --- a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md +++ b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md @@ -107,8 +107,8 @@ This search is to detect execution of wevtutil.exe to disable logs. This techniq #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **disable_logs_using_wevtutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md index d895f70a46..5c7f7d0575 100644 --- a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md +++ b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md @@ -102,8 +102,8 @@ This search is to detect a modification of file or directory permission using ta #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **permission_modification_using_takeown_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md b/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md index 6c6cf0c524..3d95cf36ad 100644 --- a/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md +++ b/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md @@ -105,8 +105,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_creating_thread_mutex_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-powershell_domain_enumeration.md b/docs/_posts/2021-06-10-powershell_domain_enumeration.md index ddf93250e3..0757c652df 100644 --- a/docs/_posts/2021-06-10-powershell_domain_enumeration.md +++ b/docs/_posts/2021-06-10-powershell_domain_enumeration.md @@ -107,8 +107,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_domain_enumeration_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md b/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md index 22736ee8b4..667a553d34 100644 --- a/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md +++ b/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md @@ -107,8 +107,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_loading_dotnet_into_memory_via_reflection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md b/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md index 4653bf74ad..b71eb3e434 100644 --- a/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md +++ b/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md @@ -105,8 +105,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_processing_stream_of_data_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md index 63c2fafb1b..b4c8dfb0b9 100644 --- a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md +++ b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md @@ -102,8 +102,8 @@ This search is to detect a suspicious bcdedit.exe execution to ignore all failur #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **prevent_automatic_repair_mode_using_bcdedit_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-recon_using_wmi_class.md b/docs/_posts/2021-06-10-recon_using_wmi_class.md index 4c8d730be6..d8de0164f3 100644 --- a/docs/_posts/2021-06-10-recon_using_wmi_class.md +++ b/docs/_posts/2021-06-10-recon_using_wmi_class.md @@ -100,8 +100,8 @@ The following analytic identifies suspicious PowerShell via EventCode 4104, wher #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **recon_using_wmi_class_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md b/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md index 35dc4c2b53..6e8073b494 100644 --- a/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md +++ b/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md @@ -100,8 +100,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **wmi_recon_running_process_or_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md index ff2ea0cea2..f638d3f37f 100644 --- a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md +++ b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md @@ -115,8 +115,8 @@ The following analytic utilizes Windows Event ID 1100 to identify when Windows e #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_event_log_service_behavior_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md index f41f7f15d2..d4cd44e404 100644 --- a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md +++ b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md @@ -107,8 +107,8 @@ This analytic will identify suspicious process of cscript.exe where it tries to #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **execute_javascript_with_jscript_com_clsid_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md b/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md index 85426be232..937bb94c5e 100644 --- a/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md +++ b/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md @@ -106,8 +106,8 @@ This search is to detect a suspicious enabling of smb1protocol through "powershe #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_enable_smb1protocol_feature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md index eb65981ea1..5016caf9db 100644 --- a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md +++ b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md @@ -107,9 +107,9 @@ This search is to detect a suspicious commandline designed to delete files or di #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **recursive_delete_of_directory_in_batch_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md index 0c89987a33..2e6ea9a74d 100644 --- a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md +++ b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md @@ -107,9 +107,9 @@ This search is to detect a suspicious modification of firewall to allow file and #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **allow_file_and_printing_sharing_in_firewall_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md index 6993027c8a..4159341610 100644 --- a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md +++ b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md @@ -107,9 +107,9 @@ This search is to detect a suspicious modification to the firewall to allow netw #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **allow_network_discovery_in_firewall_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md index ef62d7eafc..c25832cc7b 100644 --- a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md +++ b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md @@ -108,8 +108,8 @@ This detection targets behaviors observed when threat actors have used sc.exe to #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **excessive_number_of_service_control_start_as_disabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md index a0f829606a..2ce03df914 100644 --- a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md +++ b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md @@ -117,8 +117,8 @@ During triage, isolate the endpoint and review for source of exploitation. Captu #### Macros The SPL above uses the following Macros: -* [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) > :information_source: > **print_spooler_adding_a_printer_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md index d5094a4a8e..081961e406 100644 --- a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md +++ b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md @@ -118,8 +118,8 @@ During triage, isolate the endpoint and review for source of exploitation. Captu #### Macros The SPL above uses the following Macros: -* [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) > :information_source: > **print_spooler_failed_to_load_a_plug-in_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md index ec07f63c94..1ba3a1ef1b 100644 --- a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md +++ b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md @@ -114,9 +114,9 @@ The following analytic identifies a suspicious child process, `rundll32.exe`, wi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **spoolsv_spawning_rundll32_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md index d736ada874..6a27da8bc7 100644 --- a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md +++ b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md @@ -111,8 +111,8 @@ This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in no #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **msmpeng_application_dll_side_loading_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md index 324bc9edb8..7842e34ab8 100644 --- a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md +++ b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md @@ -107,9 +107,9 @@ This search is to identifies a modification in registry to disable the windows d #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_disable_security_monitoring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md index 9c8e890bd2..cc2b500868 100644 --- a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md +++ b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md @@ -122,8 +122,8 @@ This search looks for cloud compute instances created by users who have not crea #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **cloud_compute_instance_created_by_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-19-aws_createloginprofile.md b/docs/_posts/2021-07-19-aws_createloginprofile.md index 395fb43b45..2f43689227 100644 --- a/docs/_posts/2021-07-19-aws_createloginprofile.md +++ b/docs/_posts/2021-07-19-aws_createloginprofile.md @@ -116,8 +116,8 @@ This search looks for AWS CloudTrail events where a user A(victim A) creates a l #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **aws_createloginprofile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md index d7b9b393f5..6c3e88a3a7 100644 --- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md +++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md @@ -115,8 +115,8 @@ This search looks for AWS CloudTrail events where a user has created an open/pub #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **detect_new_open_s3_buckets_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md index e8abc8052d..fae0ca6e88 100644 --- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md +++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md @@ -108,8 +108,8 @@ This search looks for AWS CloudTrail events where a user has created an open/pub #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **detect_new_open_s3_buckets_over_aws_cli_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md index bc64df7088..18015756a1 100644 --- a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md +++ b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md @@ -108,8 +108,8 @@ This search is to detect a suspicious mshta.exe process that spawn rundll32 or r #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) > :information_source: diff --git a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md index 1a8abd0c7d..cb00cd3555 100644 --- a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md +++ b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md @@ -107,9 +107,9 @@ this search is to detect a suspicious office product process that spawn cmd chil #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **office_product_spawn_cmd_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md b/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md index 1f08a24b4d..ba50bfd6fb 100644 --- a/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md +++ b/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md @@ -112,8 +112,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **detect_copy_of_shadowcopy_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md index 9264ea657c..28900d90cb 100644 --- a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md +++ b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md @@ -107,9 +107,9 @@ This search is to detect a suspicious rundll32.exe commandline to execute dll fi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_icedid_rundll32_cmdline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md index e63dc15bff..d98db3cc5a 100644 --- a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md +++ b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md @@ -107,9 +107,9 @@ This search is to detect a suspicious rundll32.exe process with plugininit param #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_rundll32_plugininit_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-27-chcp_command_execution.md b/docs/_posts/2021-07-27-chcp_command_execution.md index e779aef587..b665569a64 100644 --- a/docs/_posts/2021-07-27-chcp_command_execution.md +++ b/docs/_posts/2021-07-27-chcp_command_execution.md @@ -102,8 +102,8 @@ This search is to detect execution of chcp.exe application. this utility is used #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **chcp_command_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md index 9da25e52ad..96458e18c1 100644 --- a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md +++ b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md @@ -107,8 +107,8 @@ This search is to detect a suspicious un-installation of application using msiex #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **uninstall_app_using_msiexec_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-11-fsutil_zeroing_file.md b/docs/_posts/2021-08-11-fsutil_zeroing_file.md index d250310e6a..cf2f3085c5 100644 --- a/docs/_posts/2021-08-11-fsutil_zeroing_file.md +++ b/docs/_posts/2021-08-11-fsutil_zeroing_file.md @@ -102,8 +102,8 @@ This search is to detect a suspicious fsutil process to zeroing a target file. T #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **fsutil_zeroing_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md index e9fe2ca201..2ffcffc326 100644 --- a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md +++ b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md @@ -107,8 +107,8 @@ This search is to detect a suspicious 7z process with commandline pointing to SM #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **7zip_commandline_to_smb_share_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md index 9564e9e876..00bccf02c8 100644 --- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md +++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md @@ -119,8 +119,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **aws_ecr_container_scanning_findings_high_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md index 8bda2214bc..d96bb8f419 100644 --- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md +++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md @@ -119,8 +119,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **aws_ecr_container_scanning_findings_low_informational_unknown_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md index 0b4f00180d..627b13cfc4 100644 --- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md +++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md @@ -119,8 +119,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **aws_ecr_container_scanning_findings_medium_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-18-esentutl_sam_copy.md b/docs/_posts/2021-08-18-esentutl_sam_copy.md index 119d3124c1..a6c235bac4 100644 --- a/docs/_posts/2021-08-18-esentutl_sam_copy.md +++ b/docs/_posts/2021-08-18-esentutl_sam_copy.md @@ -107,9 +107,9 @@ The following analytic identifies the process - `esentutl.exe` - being used to c #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_esentutl](https://github.com/splunk/security_content/blob/develop/macros/process_esentutl.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **esentutl_sam_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md index 7a1ef37c9a..6fc836489c 100644 --- a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md +++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md @@ -115,8 +115,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **aws_ecr_container_upload_outside_business_hours_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md index 50136f2f48..5a3ba78959 100644 --- a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md +++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md @@ -115,9 +115,9 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [aws_ecr_users](https://github.com/splunk/security_content/blob/develop/macros/aws_ecr_users.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **aws_ecr_container_upload_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md index cd7873937d..60c6036b42 100644 --- a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md +++ b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md @@ -105,8 +105,8 @@ The following analytic identifies cleartext protocols at risk of leaking sensiti #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **protocols_passing_authentication_in_cleartext_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md index d467a3d42a..ac0fc91be6 100644 --- a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md +++ b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md @@ -113,8 +113,8 @@ This search uses the Kubernetes logs from a nginx ingress controller to detect l #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [kubernetes_container_controller](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_container_controller.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **kubernetes_nginx_ingress_lfi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md index 55b0cd8cf1..3fbd261d84 100644 --- a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md +++ b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getlocaluser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md index 65ed551ddb..1ae86ca355 100644 --- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md +++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getwmiobject_user_account_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md index 6a544a3ab2..5154dc678b 100644 --- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md +++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getwmiobject_user_account_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md index d62060e513..ab149bc49c 100644 --- a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md +++ b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md @@ -113,8 +113,8 @@ This search uses the Kubernetes logs from a nginx ingress controller to detect r #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [kubernetes_container_controller](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_container_controller.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **kubernetes_nginx_ingress_rfi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md index ea9a9b6194..5f2ea3159e 100644 --- a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md +++ b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **adsisearcher_account_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md index 6161794c2a..2ed18073be 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **domain_account_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md index 68b6e25aab..9447086524 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md @@ -107,9 +107,9 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **domain_account_discovery_with_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md index 0f8edcb217..35ae4c525e 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **domain_account_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md index 1c692cdaee..ea11ee0232 100644 --- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md +++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md @@ -102,8 +102,8 @@ This analytic identifies Get-DomainTrust from PowerView in order to gather domai #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **get-domaintrust_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md index 05ece5ca7d..73f076029d 100644 --- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md @@ -102,8 +102,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **get-domaintrust_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell.md b/docs/_posts/2021-08-24-get_aduser_with_powershell.md index 99d7a6b93d..0a1bc88c75 100644 --- a/docs/_posts/2021-08-24-get_aduser_with_powershell.md +++ b/docs/_posts/2021-08-24-get_aduser_with_powershell.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **get_aduser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md b/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md index 2885ec9bca..983227c015 100644 --- a/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **get_aduser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md index 5e3ccc9ec7..00faa196d4 100644 --- a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md +++ b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **get_domainuser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md index 12ffa406ce..4b1da86585 100644 --- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md +++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getwmiobject_ds_user_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md index c090f4f54a..85d80cf3e0 100644 --- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getwmiobject_ds_user_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md b/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md index 56e7aa0105..1d73972dff 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **domain_group_discovery_with_adsisearcher_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md index aa06e4111a..346c0b4ae4 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `net.exe` with command-line arguments u #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **domain_group_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md index 53315ed956..5549827dd9 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **domain_group_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md index eb3df3262c..cd7c57ded7 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-l #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **elevated_group_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md index 95bcfb93d3..98c721908f 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **elevated_group_discovery_with_powerview_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md index 289891f3b1..f31eb06efa 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **elevated_group_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-getadgroup_with_powershell.md b/docs/_posts/2021-08-25-getadgroup_with_powershell.md index 78d29754ca..c1130fdbc7 100644 --- a/docs/_posts/2021-08-25-getadgroup_with_powershell.md +++ b/docs/_posts/2021-08-25-getadgroup_with_powershell.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getadgroup_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md index bd53c4c7a6..a166e237ad 100644 --- a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md +++ b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getdomaingroup_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md index ad340cae7a..b56d16194b 100644 --- a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md +++ b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line util #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getnettcpconnection_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md index 4ec21d1676..3db9586806 100644 --- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md +++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getwmiobject_ds_group_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md index 52ea5b8660..1459f1acb7 100644 --- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md +++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getwmiobject_ds_group_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md index b95ef0b2e8..5d25f49cba 100644 --- a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` executing the Get-ADDe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **get_addefaultdomainpasswordpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md index 2e9ec509b7..e278c8d820 100644 --- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` executing the Get ADUs #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **get_aduserresultantpasswordpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md index ff79a04102..3d7f3879c5 100644 --- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md @@ -100,8 +100,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **get_aduserresultantpasswordpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md index 68210802d9..c2e1d92b4b 100644 --- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` executing the `Get-Dom #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **get_domainpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md index ee64ac4113..f458409ba1 100644 --- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md @@ -100,8 +100,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **get_domainpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md b/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md index 545ab393fc..7b0607e962 100644 --- a/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getdomaingroup_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md index 7f195b6c3d..4cdf009cfa 100644 --- a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md +++ b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command li #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **password_policy_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md index b15a922a25..d8b606a7ef 100644 --- a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md +++ b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md @@ -121,8 +121,8 @@ This search looks for a process launching an `*.lnk` file under `C:\User*` or `* #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **process_creating_lnk_file_in_suspicious_location_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md index 38f8098ad8..4ed53fb857 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md +++ b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md @@ -111,8 +111,8 @@ Module - New-managementroleassignment can assign a management role to a manageme #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **exchange_powershell_module_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md index a7a7709f4a..8b4e1daf49 100644 --- a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md +++ b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `nltest.exe` with command-line argument #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **domain_controller_discovery_with_nltest_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md index 933e997068..34de9a917a 100644 --- a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md +++ b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **remote_system_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md index 7ae0dd38c1..74fd24e098 100644 --- a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md +++ b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md @@ -108,8 +108,8 @@ During triage, review parallel security events to identify further suspicious ac #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **petitpotam_network_share_access_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md index 639b6ff4aa..097e4595bc 100644 --- a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md +++ b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md @@ -105,8 +105,8 @@ The following analytic identifes Event Code 4768, A `Kerberos authentication tic #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **petitpotam_suspicious_kerberos_tgt_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md index 1526c5c5e8..f04ca91335 100644 --- a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md +++ b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **remote_system_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md index 6158e6df76..fed4ecbd94 100644 --- a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md +++ b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **domain_controller_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md index 9534f2d6fd..5bbe8e09bc 100644 --- a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md +++ b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **domain_group_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md index 9f6011c46d..b9e7f01b8a 100644 --- a/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getadcomputer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md index 9ef16fa75a..9170f1ee06 100644 --- a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getwmiobject_ds_computer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md index 85e105186d..5472ee8db6 100644 --- a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md +++ b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md @@ -115,8 +115,8 @@ This search looks for Pull Request from unknown user. #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) * [github_known_users](https://github.com/splunk/security_content/blob/develop/macros/github_known_users.yml) +* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) > :information_source: > **github_pull_request_from_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md b/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md index f62c1c6ce5..4f4365757b 100644 --- a/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md +++ b/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **remote_system_discovery_with_adsisearcher_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md index d2cbc9336e..eea36a44e0 100644 --- a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md +++ b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **remote_system_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md index dfa36ed572..35ff69f6e7 100644 --- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md +++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md @@ -102,8 +102,8 @@ This analytic identifies Get-ForestTrust from PowerSploit in order to gather dom #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **get-foresttrust_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md index 6004b1416c..daeb19634d 100644 --- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md @@ -102,8 +102,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **get-foresttrust_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md b/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md index f35dfdad93..e820fccf06 100644 --- a/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getdomaincomputer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md b/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md index 6438259673..97f3ed9faf 100644 --- a/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getdomaincontroller_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md index ac2289bd7c..88e16dfd41 100644 --- a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md +++ b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md @@ -102,8 +102,8 @@ This search is to detect a suspicious bcdedit commandline to configure the host #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **bcdedit_command_back_to_normal_mode_boot_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md index fda1a61b06..bd0b7da87a 100644 --- a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md +++ b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md @@ -102,8 +102,8 @@ This search is to detect a suspicious bcdedit commandline to configure the host #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **change_to_safe_mode_with_network_config_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md index 90bf4429ed..f651563fe7 100644 --- a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md +++ b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getadcomputer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md index 713fbc5000..518a0b9f38 100644 --- a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md +++ b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getdomaincomputer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md index d908a9d014..fce0306599 100644 --- a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md +++ b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getdomaincontroller_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md index fb7d6d46cf..db435f2c37 100644 --- a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md +++ b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getwmiobject_ds_computer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-07-system_information_discovery_detection.md b/docs/_posts/2021-09-07-system_information_discovery_detection.md index a1f26d2874..6284fd84fb 100644 --- a/docs/_posts/2021-09-07-system_information_discovery_detection.md +++ b/docs/_posts/2021-09-07-system_information_discovery_detection.md @@ -110,8 +110,8 @@ Detect system information discovery techniques used by attackers to understand c #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **system_information_discovery_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md index 594531298f..48003e4082 100644 --- a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md +++ b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md @@ -112,8 +112,8 @@ The following detection identifies control.exe loading either a .cpl or .inf fro #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **control_loading_from_world_writable_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md index d82a61ca56..fd396ad9ae 100644 --- a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md +++ b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md @@ -112,8 +112,8 @@ This search looks for the creation of local administrator accounts using net.exe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **create_local_admin_accounts_using_net_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-08-office_spawning_control.md b/docs/_posts/2021-09-08-office_spawning_control.md index aec0d7cc2e..524134cc6c 100644 --- a/docs/_posts/2021-09-08-office_spawning_control.md +++ b/docs/_posts/2021-09-08-office_spawning_control.md @@ -112,8 +112,8 @@ The following detection identifies control.exe spawning from an office product. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **office_spawning_control_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md index 8b8a3ff9c7..d3c5f687fc 100644 --- a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md +++ b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md @@ -112,9 +112,9 @@ The following hunting detection identifies rundll32.exe with `control_rundll` wi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **rundll32_control_rundll_hunt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md index b9e405aef2..be6923c996 100644 --- a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md +++ b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md @@ -112,9 +112,9 @@ The following detection identifies rundll32.exe with `control_rundll` within the #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **rundll32_control_rundll_world_writable_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md b/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md index 9cbc7d7180..0d5361e0f4 100644 --- a/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md +++ b/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getnettcpconnection_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md index c89ce7ea75..e21ffecea2 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `arp.exe` utilized to get a listing of #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **network_connection_discovery_with_arp_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md index 309880bcb5..155e7de23b 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `net.exe` with command-line arguments u #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **network_connection_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md index 02afe963b8..810c81f80b 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `netstat.exe` with command-line argumen #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **network_connection_discovery_with_netstat_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md index 7e6072e5ca..d0d660741e 100644 --- a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md +++ b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powerhsell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getcurrent_user_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md index 8ffd3e7b82..86b5c55d90 100644 --- a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md +++ b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md @@ -107,8 +107,8 @@ This search is to detect a execution of jscript using cscript process. Commonly #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **jscript_execution_using_cscript_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_query.md b/docs/_posts/2021-09-13-system_user_discovery_with_query.md index 3d5f542883..b62e73bfdf 100644 --- a/docs/_posts/2021-09-13-system_user_discovery_with_query.md +++ b/docs/_posts/2021-09-13-system_user_discovery_with_query.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `query.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **system_user_discovery_with_query_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md index 6c269f5979..027b3910fe 100644 --- a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md +++ b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `whoami.exe` without any arguments. Thi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **system_user_discovery_with_whoami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md index 52e651933e..92435c9d5c 100644 --- a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md +++ b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **user_discovery_with_env_vars_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md index 7799ae5de6..39c3fd69f7 100644 --- a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md +++ b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md @@ -102,9 +102,9 @@ This search is to detect a suspicious wmic.exe process or renamed wmic process t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **xsl_script_execution_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md index d1a4c191e5..f2b0e43e0d 100644 --- a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md +++ b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md @@ -107,8 +107,8 @@ The following analytic identifies a non-standard parent process (not matching CM #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **cmdline_tool_not_executed_in_cmd_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md index 0c112c1c9b..624f0c31d3 100644 --- a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md +++ b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md @@ -107,8 +107,8 @@ The following hunting analytic identifies the use of `Get-WMIObject Win32_Group` #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **get_wmiobject_group_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-14-net_localgroup_discovery.md b/docs/_posts/2021-09-14-net_localgroup_discovery.md index c71e0bfd9a..0284a73976 100644 --- a/docs/_posts/2021-09-14-net_localgroup_discovery.md +++ b/docs/_posts/2021-09-14-net_localgroup_discovery.md @@ -107,8 +107,8 @@ The following hunting analytic will identify the use of localgroup discovery usi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **net_localgroup_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md index d1cfcb3cc0..3356fed25c 100644 --- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md +++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md @@ -107,8 +107,8 @@ The following hunting analytic identifies the use of `get-localgroup` being used #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_get_localgroup_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md index 96189c8f79..406541d7d5 100644 --- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md +++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md @@ -107,8 +107,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_get_localgroup_discovery_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-14-wmic_group_discovery.md b/docs/_posts/2021-09-14-wmic_group_discovery.md index 4934e04504..c697bf5232 100644 --- a/docs/_posts/2021-09-14-wmic_group_discovery.md +++ b/docs/_posts/2021-09-14-wmic_group_discovery.md @@ -109,8 +109,8 @@ During triage, review parallel processes and identify any further suspicious beh #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **wmic_group_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md index 694618f1b7..4c8a4013eb 100644 --- a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md +++ b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md @@ -102,8 +102,8 @@ This search is to detect a suspicious whoami execution to check if the cmd or sh #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **check_elevated_cmd_using_whoami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md index d8ee054155..9f48a1bb5b 100644 --- a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md +++ b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md @@ -106,8 +106,8 @@ This search is to detect an anomaly event of non-chrome process accessing the fi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **non_chrome_process_accessing_chrome_default_dir_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md index a2d1d3b7c1..eb47910925 100644 --- a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md +++ b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md @@ -106,8 +106,8 @@ This search is to detect an anomaly event of non-firefox process accessing the f #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **non_firefox_process_access_firefox_profile_dir_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-account_discovery_with_net_app.md b/docs/_posts/2021-09-16-account_discovery_with_net_app.md index aebb4338a1..a0a76338f0 100644 --- a/docs/_posts/2021-09-16-account_discovery_with_net_app.md +++ b/docs/_posts/2021-09-16-account_discovery_with_net_app.md @@ -108,9 +108,9 @@ this search is to detect a potential account discovery series of command used by #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **account_discovery_with_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md index fb65fae26a..7b0a826dbb 100644 --- a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md +++ b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md @@ -116,9 +116,9 @@ Attempt To Add Certificate To Untrusted Store #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **attempt_to_add_certificate_to_untrusted_store_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md index 43ce2e7a48..03592ce7d2 100644 --- a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md +++ b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md @@ -113,9 +113,9 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-bits_job_persistence.md b/docs/_posts/2021-09-16-bits_job_persistence.md index 1de2af652c..4bacba5373 100644 --- a/docs/_posts/2021-09-16-bits_job_persistence.md +++ b/docs/_posts/2021-09-16-bits_job_persistence.md @@ -103,9 +103,9 @@ The following query identifies Microsoft Background Intelligent Transfer Service #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **bits_job_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-bitsadmin_download_file.md b/docs/_posts/2021-09-16-bitsadmin_download_file.md index d2c8c7bf2d..b7c07192d5 100644 --- a/docs/_posts/2021-09-16-bitsadmin_download_file.md +++ b/docs/_posts/2021-09-16-bitsadmin_download_file.md @@ -108,9 +108,9 @@ The following query identifies Microsoft Background Intelligent Transfer Service #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **bitsadmin_download_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md index 7b9f556da7..2b93b8622b 100644 --- a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md +++ b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md @@ -112,10 +112,10 @@ This search detects the use of wmic and Powershell to create a shadow copy. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **creation_of_shadow_copy_with_wmic_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md index dcf5dcfcc6..4df0255546 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md @@ -112,9 +112,9 @@ This search detects credential dumping using copy command from a shadow copy. #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **credential_dumping_via_copy_command_from_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md index 07f3c1ee10..e216f6991c 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md @@ -112,9 +112,9 @@ This search detects the creation of a symlink to a shadow copy. #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **credential_dumping_via_symlink_to_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md index 68d5bbbde4..e2b85b66f6 100644 --- a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md @@ -112,8 +112,8 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: -* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md index 6aab4f0981..d87f495d7a 100644 --- a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md +++ b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md @@ -112,8 +112,8 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: -* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md index 778d8b6ff4..94be623f27 100644 --- a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md +++ b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md @@ -112,9 +112,9 @@ The following analytic identifies "mshta.exe" execution with inline protocol han #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_mshta_inline_hta_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md index 7ec5743895..8b03c85b2b 100644 --- a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md @@ -112,9 +112,9 @@ This analytic identifies when Microsoft HTML Application Host (mshta.exe) utilit #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_mshta_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md index 1dea81ca3d..2fb37bbfba 100644 --- a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md +++ b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md @@ -112,9 +112,9 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_psexec_with_accepteula_flag_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_renamed_7-zip.md b/docs/_posts/2021-09-16-detect_renamed_7-zip.md index 2aa3a5d738..e00bafd53b 100644 --- a/docs/_posts/2021-09-16-detect_renamed_7-zip.md +++ b/docs/_posts/2021-09-16-detect_renamed_7-zip.md @@ -107,8 +107,8 @@ The following analytic identifies renamed 7-Zip usage using Sysmon. At this stag #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_renamed_7-zip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_renamed_rclone.md b/docs/_posts/2021-09-16-detect_renamed_rclone.md index 05f75b217e..0a4eea4ecf 100644 --- a/docs/_posts/2021-09-16-detect_renamed_rclone.md +++ b/docs/_posts/2021-09-16-detect_renamed_rclone.md @@ -101,8 +101,8 @@ The following analytic identifies the usage of `rclone.exe`, renamed, being used #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_renamed_rclone_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_renamed_winrar.md b/docs/_posts/2021-09-16-detect_renamed_winrar.md index e0a0dee5d6..fda3661084 100644 --- a/docs/_posts/2021-09-16-detect_renamed_winrar.md +++ b/docs/_posts/2021-09-16-detect_renamed_winrar.md @@ -107,8 +107,8 @@ The following analtyic identifies renamed instances of `WinRAR.exe`. In most cas #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_renamed_winrar_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md index cbd7f74e6d..b85418080b 100644 --- a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md +++ b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md @@ -114,9 +114,9 @@ During triage, confirm this is procdump.exe executing. If it is the first time a #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_procdump](https://github.com/splunk/security_content/blob/develop/macros/process_procdump.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **dump_lsass_via_procdump_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_net.md b/docs/_posts/2021-09-16-local_account_discovery_with_net.md index f4b3227e0b..c58d329d7c 100644 --- a/docs/_posts/2021-09-16-local_account_discovery_with_net.md +++ b/docs/_posts/2021-09-16-local_account_discovery_with_net.md @@ -107,9 +107,9 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **local_account_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md index 34a3d5138b..3be4ca3539 100644 --- a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md +++ b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md @@ -107,9 +107,9 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **local_account_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-office_product_spawning_wmic.md b/docs/_posts/2021-09-16-office_product_spawning_wmic.md index eed2b96620..bc01d8f37b 100644 --- a/docs/_posts/2021-09-16-office_product_spawning_wmic.md +++ b/docs/_posts/2021-09-16-office_product_spawning_wmic.md @@ -107,9 +107,9 @@ The following detection identifies the latest behavior utilized by Ursnif malwar #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **office_product_spawning_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-processes_launching_netsh.md b/docs/_posts/2021-09-16-processes_launching_netsh.md index 0e1481ce2f..d68351a19e 100644 --- a/docs/_posts/2021-09-16-processes_launching_netsh.md +++ b/docs/_posts/2021-09-16-processes_launching_netsh.md @@ -112,9 +112,9 @@ This search looks for processes launching netsh.exe. Netsh is a command-line scr #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **processes_launching_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md index cab0d16a04..b9ffbc646f 100644 --- a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md +++ b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md @@ -107,8 +107,8 @@ This search is to detect potential malicious office document executing lolbin ch #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **office_document_spawned_child_process_to_download_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md index b2b27c06ed..db772d6c3f 100644 --- a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md +++ b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md @@ -102,8 +102,8 @@ This search is to detect file creation in remcos folder in appdata which is the #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **remcos_rat_file_creation_in_remcos_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-27-change_default_file_association.md b/docs/_posts/2021-09-27-change_default_file_association.md index cb7c02689c..4244fd0b89 100644 --- a/docs/_posts/2021-09-27-change_default_file_association.md +++ b/docs/_posts/2021-09-27-change_default_file_association.md @@ -109,8 +109,8 @@ This analytic is developed to detect suspicious registry modification to change #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **change_default_file_association_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md index c65717412e..c9b808f974 100644 --- a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md +++ b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md @@ -109,8 +109,8 @@ This search is to detect a suspicious modification of registry entry to persist #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **logon_script_event_trigger_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md index b84ed3e5c4..e692c931a0 100644 --- a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md +++ b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md @@ -109,8 +109,8 @@ This analytic is developed to detect possible event trigger execution through sc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **screensaver_event_trigger_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-28-print_processor_registry_autostart.md b/docs/_posts/2021-09-28-print_processor_registry_autostart.md index d0cbefcb3b..7271d312a2 100644 --- a/docs/_posts/2021-09-28-print_processor_registry_autostart.md +++ b/docs/_posts/2021-09-28-print_processor_registry_autostart.md @@ -111,8 +111,8 @@ This analytic is to detect a suspicious modification or new registry entry regar #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **print_processor_registry_autostart_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-29-verclsid_clsid_execution.md b/docs/_posts/2021-09-29-verclsid_clsid_execution.md index be4fd3f7ba..75b2827a98 100644 --- a/docs/_posts/2021-09-29-verclsid_clsid_execution.md +++ b/docs/_posts/2021-09-29-verclsid_clsid_execution.md @@ -107,9 +107,9 @@ This analytic is to detect a possible abuse of verclsid to execute malicious fil #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_verclsid](https://github.com/splunk/security_content/blob/develop/macros/process_verclsid.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **verclsid_clsid_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md index e3c8f76556..542a0c8b46 100644 --- a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md +++ b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md @@ -107,8 +107,8 @@ This analytic is to detect a suspicious wscript commandline to execute vbscript. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **vbscript_execution_using_wscript_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md index 2d634ce925..1a8935aa00 100644 --- a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md +++ b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md @@ -107,9 +107,9 @@ This analytic is to detect a suspicious child process of MSBuild spawned by Wind #### Macros The SPL above uses the following Macros: -* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) > :information_source: > **msbuild_suspicious_spawned_by_script_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md index f72b3e29df..04b84d8c5e 100644 --- a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md +++ b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md @@ -112,8 +112,8 @@ The following analytic identifies a process modifying the registry with a known #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **malicious_inprocserver32_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md index f42d4979d5..f0c83e517f 100644 --- a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md +++ b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md @@ -112,8 +112,8 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **process_writing_dynamicwrapperx_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md index f7e4a6b192..6ef68b967f 100644 --- a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md +++ b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md @@ -102,9 +102,9 @@ This analytic is to detect a suspicious rundll32 commandline to clear shim cache #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **rundll32_shimcache_flush_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md index 0fbefce559..899a5b9487 100644 --- a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md +++ b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md @@ -103,8 +103,8 @@ The following analytic identifies winhlp32.exe, found natively in `c:\windows\`, #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **winhlp32_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-06-sdelete_application_execution.md b/docs/_posts/2021-10-06-sdelete_application_execution.md index d81e1b179e..1ada946924 100644 --- a/docs/_posts/2021-10-06-sdelete_application_execution.md +++ b/docs/_posts/2021-10-06-sdelete_application_execution.md @@ -112,9 +112,9 @@ This analytic is to detect the execution of sdelete.exe application sysinternal #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_sdelete](https://github.com/splunk/security_content/blob/develop/macros/process_sdelete.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **sdelete_application_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md index 238d194fdd..4a2f07702a 100644 --- a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md +++ b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md @@ -121,8 +121,8 @@ This analytic identifies a suspicious spawned process by WScript or CScript proc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **wscript_or_cscript_suspicious_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md index 762e377e0f..1834efe99a 100644 --- a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md +++ b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md @@ -118,8 +118,8 @@ The wevtutil.exe application is the windows event log utility. This searches for #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_wevtutil_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md index c6a43b9ce7..1d8f99d51b 100644 --- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md +++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md @@ -104,8 +104,8 @@ During triage, review parallel processes for further suspicious activity. #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **serviceprincipalnames_discovery_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md index 28feffa6ea..169275b0e6 100644 --- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md +++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md @@ -109,9 +109,9 @@ During triage, review parallel processes for further suspicious activity. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_setspn](https://github.com/splunk/security_content/blob/develop/macros/process_setspn.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **serviceprincipalnames_discovery_with_setspn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-18-disable_schedule_task.md b/docs/_posts/2021-10-18-disable_schedule_task.md index 1b4cfa60ad..cc6eee3d12 100644 --- a/docs/_posts/2021-10-18-disable_schedule_task.md +++ b/docs/_posts/2021-10-18-disable_schedule_task.md @@ -107,8 +107,8 @@ This analytic is to detect a suspicious commandline to disable existing schedule #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **disable_schedule_task_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md index 0285716fab..914973d141 100644 --- a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md +++ b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md @@ -104,8 +104,8 @@ During triage, review parallel processes for further behavior. In addition, iden #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml) > :information_source: diff --git a/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md b/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md index d893b1bbd3..8b58d45823 100644 --- a/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md +++ b/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md @@ -104,8 +104,8 @@ The following hunting analytic assists with identifying suspicious tasks that ha #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_task_scheduler](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_task_scheduler.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **winevent_windows_task_scheduler_event_action_started_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md b/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md index 12dc7340c3..34f97c1258 100644 --- a/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md +++ b/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md @@ -107,8 +107,8 @@ This analytic is to detect a suspicious wmic commandlined that uninstall applica #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **wmic_noninteractive_app_uninstallation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-03-windows_adfind_exe.md b/docs/_posts/2021-11-03-windows_adfind_exe.md index bd276cdce8..ff6f6a8875 100644 --- a/docs/_posts/2021-11-03-windows_adfind_exe.md +++ b/docs/_posts/2021-11-03-windows_adfind_exe.md @@ -107,8 +107,8 @@ This search looks for the execution of `adfind.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_adfind_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md b/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md index fd0857c133..e9d0341f4a 100644 --- a/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md +++ b/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md @@ -126,8 +126,8 @@ This search looks for execution of commonly used attacker tools on an endpoint. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **attacker_tools_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md index ab3efa98b0..36ae640924 100644 --- a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md +++ b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md @@ -106,8 +106,8 @@ Adversaries may use one of the three methods based on the remote destination and #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml) > :information_source: diff --git a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md index be55e557b9..00688011cc 100644 --- a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md +++ b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md @@ -109,8 +109,8 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_service_creation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md index 30f8951fe7..e3f0c5a257 100644 --- a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md +++ b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md @@ -109,8 +109,8 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_service_initiation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md index 4adbe759e9..5bb1da6c62 100644 --- a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md +++ b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `winrs.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **remote_process_instantiation_via_winrm_and_winrs_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md index 9efa6c3b0c..d5f4812d79 100644 --- a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md +++ b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md @@ -111,8 +111,8 @@ This analytic looks for the execution of `at.exe` with command-line arguments ut #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **scheduled_task_creation_on_remote_endpoint_using_at_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md index 8f7eb63971..7c615d89a5 100644 --- a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md +++ b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md @@ -111,8 +111,8 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **scheduled_task_initiation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md index 3e2d9784e0..6e8a86eaef 100644 --- a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md +++ b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md @@ -102,9 +102,9 @@ The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible St #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **wmic_xsl_execution_via_url_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md b/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md index 6e3ae286d2..0d1451a1db 100644 --- a/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md +++ b/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md @@ -102,8 +102,8 @@ The following detection identifies excessive AccessDenied events within an hour #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **aws_iam_accessdenied_discovery_events_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md index e393521d7a..3a1c7dbb39 100644 --- a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md +++ b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md @@ -107,9 +107,9 @@ this analytic is to detect a suspicious compile before delivery approach of .net #### Macros The SPL above uses the following Macros: -* [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml) > :information_source: > **csc_net_on_the_fly_compilation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-firewall_allowed_program_enable.md b/docs/_posts/2021-11-12-firewall_allowed_program_enable.md index 53ded3f04c..73fc2febe1 100644 --- a/docs/_posts/2021-11-12-firewall_allowed_program_enable.md +++ b/docs/_posts/2021-11-12-firewall_allowed_program_enable.md @@ -107,8 +107,8 @@ This analytic detects a potential suspicious modification of firewall rule allow #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **firewall_allowed_program_enable_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md index 971dd3bbde..5815a33c8f 100644 --- a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md +++ b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md @@ -107,9 +107,9 @@ This analytic look for a spawned process of route.exe windows application. Adver #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_route](https://github.com/splunk/security_content/blob/develop/macros/process_route.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **network_discovery_using_route_windows_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md index 59357aa8f6..f061dea140 100644 --- a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md +++ b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md @@ -110,9 +110,9 @@ This analytic identifies wmic.exe being launched with parameters to spawn a proc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **remote_process_instantiation_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-runas_execution_in_commandline.md b/docs/_posts/2021-11-12-runas_execution_in_commandline.md index 44ab86c0bc..b880fd8656 100644 --- a/docs/_posts/2021-11-12-runas_execution_in_commandline.md +++ b/docs/_posts/2021-11-12-runas_execution_in_commandline.md @@ -110,8 +110,8 @@ This analytic look for a spawned runas.exe process with a administrator user opt #### Macros The SPL above uses the following Macros: * [process_runas](https://github.com/splunk/security_content/blob/develop/macros/process_runas.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **runas_execution_in_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md index 55bc046bbd..1eb00cabc5 100644 --- a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md +++ b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md @@ -112,8 +112,8 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_installutil_uninstall_option_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md index c2736e0ce1..528f6b0294 100644 --- a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md +++ b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md @@ -111,8 +111,8 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_installutil_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md index 37b92ca050..487bed8e17 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md @@ -107,9 +107,9 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **remote_process_instantiation_via_dcom_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md index 133e5e5ae1..a851c73030 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md @@ -102,9 +102,9 @@ This analytic looks for the execution of `powershell.exe` leveraging the `Invoke #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **remote_process_instantiation_via_wmi_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md index b8856a3372..7b124d8434 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **remote_process_instantiation_via_wmi_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-15-windows_diskcryptor_usage.md b/docs/_posts/2021-11-15-windows_diskcryptor_usage.md index 9d36129ad0..f6a1e66377 100644 --- a/docs/_posts/2021-11-15-windows_diskcryptor_usage.md +++ b/docs/_posts/2021-11-15-windows_diskcryptor_usage.md @@ -102,8 +102,8 @@ The following analytic identifies DiskCryptor process name of dcrypt.exe or int #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_diskcryptor_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md index d611b7f432..e8b4827906 100644 --- a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md +++ b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md @@ -107,9 +107,9 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **remote_process_instantiation_via_winrm_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-17-windows_dism_remove_defender.md b/docs/_posts/2021-11-17-windows_dism_remove_defender.md index 407e0e576c..de4bb52790 100644 --- a/docs/_posts/2021-11-17-windows_dism_remove_defender.md +++ b/docs/_posts/2021-11-17-windows_dism_remove_defender.md @@ -107,8 +107,8 @@ The following analytic identifies the use of the Windows Disk Image Utility, `di #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_dism_remove_defender_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md index 04a37eba8b..61fc5ef9a0 100644 --- a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md +++ b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md @@ -105,8 +105,8 @@ The following analytic identifies executable files (.exe or .dll) being written #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **executable_file_written_in_administrative_smb_share_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md index 139b376069..906c6e84dd 100644 --- a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md +++ b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md @@ -102,9 +102,9 @@ This analytic is to detect a suspicious dxdiag.exe process command-line executio #### Macros The SPL above uses the following Macros: -* [process_dxdiag](https://github.com/splunk/security_content/blob/develop/macros/process_dxdiag.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_dxdiag](https://github.com/splunk/security_content/blob/develop/macros/process_dxdiag.yml) > :information_source: > **system_info_gathering_using_dxdiag_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md index a240857b3c..0302e0e287 100644 --- a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md +++ b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md @@ -107,8 +107,8 @@ This analytic will detect if a suspicious process contains a commandline paramet #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **possible_browser_pass_view_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md index f1d26ef0d2..4a7df02b80 100644 --- a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md @@ -109,8 +109,8 @@ The following analytic identifies `services.exe` spawning a LOLBAS execution pro #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **services_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md index 49d8668e14..6393b95a4f 100644 --- a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md @@ -111,8 +111,8 @@ The following analytic identifies `svchost.exe` spawning a LOLBAS execution proc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **svchost_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md index 44e6b12703..b547469c0b 100644 --- a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md +++ b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md @@ -105,8 +105,8 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **windows_service_created_with_suspicious_service_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md index 1c40def6e4..ddf621fad7 100644 --- a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md +++ b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md @@ -107,8 +107,8 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **windows_service_created_within_public_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md index 479ec8abb8..5020e994f5 100644 --- a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md @@ -102,8 +102,8 @@ The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution pro #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **wmiprsve_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md index cc5641f5df..4f98add5e0 100644 --- a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md @@ -107,8 +107,8 @@ The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS execution #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **wsmprovhost_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md index e794dc5af9..cc8520ac4b 100644 --- a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md @@ -107,8 +107,8 @@ The following analytic identifies `mmc.exe` spawning a LOLBAS execution process. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **mmc_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md b/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md index c4f1f46cc0..fd75d5de84 100644 --- a/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md +++ b/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md @@ -107,8 +107,8 @@ This analytic will identify a suspicious process command-line related to Windows #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **add_or_set_windows_defender_exclusion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md b/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md index 6c2914b698..9d367f82a9 100644 --- a/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md +++ b/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md @@ -106,8 +106,8 @@ This analytic will detect a suspicious process commandline related to windows de #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_windows_defender_exclusion_commands_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md index bb1802f83a..c1aa40bed2 100644 --- a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md +++ b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md @@ -102,9 +102,9 @@ This analytic identifies commonly used command-line arguments used by `rclone.ex #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_rclone](https://github.com/splunk/security_content/blob/develop/macros/process_rclone.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_rclone_command-line_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md index 7b27f7aed5..c37740f512 100644 --- a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md +++ b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md @@ -135,8 +135,8 @@ The following analytic assists with identifying a PowerShell process spawned as #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **possible_lateral_movement_powershell_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md b/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md index f70a9508fb..27fc81bebd 100644 --- a/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md +++ b/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md @@ -107,8 +107,8 @@ The search logic specifically looks for high number of distinct commands run in #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_linux_discovery_commands_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md b/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md index 2ef2e5e6e0..1979e02a34 100644 --- a/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md +++ b/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md @@ -102,8 +102,8 @@ The following analytic identifies the Raccine Rules Updater scheduled task being #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_raccine_scheduled_task_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md index 0c8c4f2440..0581a6cb2e 100644 --- a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md +++ b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md @@ -108,8 +108,8 @@ The following analytic identifies the use of curl on Linux or MacOS attempting t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **curl_download_and_bash_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md index 3247414e8f..bfed14bc43 100644 --- a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md +++ b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md @@ -108,8 +108,8 @@ The following analytic identifies the use of wget on Linux or MacOS attempting t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **wget_download_and_bash_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-13-linux_java_spawning_shell.md b/docs/_posts/2021-12-13-linux_java_spawning_shell.md index 363dd9cec2..3df3737a0f 100644 --- a/docs/_posts/2021-12-13-linux_java_spawning_shell.md +++ b/docs/_posts/2021-12-13-linux_java_spawning_shell.md @@ -107,8 +107,8 @@ The following analytic identifies the process name of Java, Apache, or Tomcat sp #### Macros The SPL above uses the following Macros: -* [linux_shells](https://github.com/splunk/security_content/blob/develop/macros/linux_shells.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [linux_shells](https://github.com/splunk/security_content/blob/develop/macros/linux_shells.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: diff --git a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md index 09319deb53..be6c7be8fc 100644 --- a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md +++ b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md @@ -124,8 +124,8 @@ CVE-2021-44228 Log4Shell payloads can be injected via various methods, but on of #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **log4shell_jndi_payload_injection_with_outbound_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md index 83df26299f..53c949a349 100644 --- a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md +++ b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md @@ -111,8 +111,8 @@ A required step while exploiting the CVE-2021-44228-Log4j vulnerability is that #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **outbound_network_connection_from_java_using_default_ports_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-13-windows_java_spawning_shells.md b/docs/_posts/2021-12-13-windows_java_spawning_shells.md index 130435c879..caf8677161 100644 --- a/docs/_posts/2021-12-13-windows_java_spawning_shells.md +++ b/docs/_posts/2021-12-13-windows_java_spawning_shells.md @@ -109,9 +109,9 @@ The following analytic identifies the process name of java.exe and w3wp.exe spaw #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_java_spawning_shells_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md b/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md index 7a887aa3c0..42cc8ce213 100644 --- a/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md +++ b/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md @@ -117,8 +117,8 @@ The following analytic identifies a suspicious file creation in known cron table #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_add_files_in_known_crontab_directories_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md b/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md index bb6a258cfd..47319dbe9c 100644 --- a/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md +++ b/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md @@ -117,8 +117,8 @@ The following analytic identifies a suspicious file creation of /etc/at.allow or #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_at_allow_config_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md b/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md index 953ced99a4..6d59c78222 100644 --- a/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md +++ b/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md @@ -117,8 +117,8 @@ The following analytic identifies a suspicious cronjobs modification using cront #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_edit_cron_table_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md b/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md index 03a9fd16f5..48da01550b 100644 --- a/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md +++ b/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md @@ -117,8 +117,8 @@ This analytic looks for possible suspicious commandline that may use to append a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md b/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md index ed0ee79276..74e771fcd1 100644 --- a/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md +++ b/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md @@ -117,8 +117,8 @@ This analytic looks for possible modification of cronjobs file using editor. Thi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_possible_cronjob_modification_with_editor_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md b/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md index 6f00971b99..8a5ef21df0 100644 --- a/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md +++ b/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md @@ -115,8 +115,8 @@ This analytic looks for suspicious file creation on init system directories for #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_file_creation_in_init_boot_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md b/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md index 2dbf6a99e7..b0fe1a2c23 100644 --- a/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md +++ b/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md @@ -115,8 +115,8 @@ This analytic looks for suspicious file creation in /etc/profile.d directory to #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_file_creation_in_profile_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md b/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md index a9fdbc8fcb..dd50e5d092 100644 --- a/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md +++ b/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md @@ -115,8 +115,8 @@ This analytic looks for suspicious command-lines that can be possibly used to mo #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_possible_append_command_to_profile_config_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md b/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md index 987f16168d..84593309e0 100644 --- a/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md +++ b/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md @@ -117,8 +117,8 @@ This analytic looks for suspicious file creation in systemd timer directory in l #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_service_file_created_in_systemd_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-20-linux_service_restarted.md b/docs/_posts/2021-12-20-linux_service_restarted.md index f35765c93a..07b80b63ae 100644 --- a/docs/_posts/2021-12-20-linux_service_restarted.md +++ b/docs/_posts/2021-12-20-linux_service_restarted.md @@ -117,8 +117,8 @@ This analytic looks for restarted or re-enable services in linux platform. This #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_service_restarted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-20-linux_service_started_or_enabled.md b/docs/_posts/2021-12-20-linux_service_started_or_enabled.md index eec3c468b0..8b5aa7f4d1 100644 --- a/docs/_posts/2021-12-20-linux_service_started_or_enabled.md +++ b/docs/_posts/2021-12-20-linux_service_started_or_enabled.md @@ -117,8 +117,8 @@ This analytic looks for created or enable services in linux platform. This techn #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_service_started_or_enabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-21-linux_add_user_account.md b/docs/_posts/2021-12-21-linux_add_user_account.md index 9584b01ede..73ed7ae760 100644 --- a/docs/_posts/2021-12-21-linux_add_user_account.md +++ b/docs/_posts/2021-12-21-linux_add_user_account.md @@ -113,8 +113,8 @@ This analytic looks for commands to create user accounts on the linux platform. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_add_user_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md b/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md index 35bdfcb666..1ee27b641b 100644 --- a/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md +++ b/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md @@ -113,8 +113,8 @@ This analytic looks for a commandline that change the file owner to root using c #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_change_file_owner_to_root_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md b/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md index 31ddc7dcaa..ff9d2ee30f 100644 --- a/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md +++ b/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md @@ -115,8 +115,8 @@ This analytic is to look for suspicious command lines that may add entry to /etc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_nopasswd_entry_in_sudoers_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md index a5ce53de0b..70cb99b0bc 100644 --- a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md +++ b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md @@ -115,8 +115,8 @@ This analytic looks for suspicious chmod utility execution to enable SUID bit. T #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_setuid_using_chmod_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md index 3f84cbaeda..f532a50a5d 100644 --- a/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md +++ b/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md @@ -115,8 +115,8 @@ This analytic looks for suspicious setcap utility execution to enable SUID bit. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_setuid_using_setcap_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-21-linux_visudo_utility_execution.md b/docs/_posts/2021-12-21-linux_visudo_utility_execution.md index 3116da0cc8..814ef3f322 100644 --- a/docs/_posts/2021-12-21-linux_visudo_utility_execution.md +++ b/docs/_posts/2021-12-21-linux_visudo_utility_execution.md @@ -115,8 +115,8 @@ This analytic is to looks for suspicious commandline that add entry to /etc/sudo #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_visudo_utility_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md b/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md index e756d513a2..66b34d739a 100644 --- a/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md +++ b/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md @@ -115,8 +115,8 @@ This analytic looks for suspicious file creation in kernel/driver directory in l #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_file_created_in_kernel_driver_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md b/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md index b2488c3634..94a25b61c5 100644 --- a/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md +++ b/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md @@ -115,8 +115,8 @@ This analytic looks for inserting of linux kernel module using insmod utility fu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_insert_kernel_module_using_insmod_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md b/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md index 7f68a84eeb..b251fd4fae 100644 --- a/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md +++ b/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md @@ -115,8 +115,8 @@ This analytic looks for possible installing a linux kernel module using modprobe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_install_kernel_module_using_modprobe_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md b/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md index ecf91245bd..8634937703 100644 --- a/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md +++ b/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md @@ -117,8 +117,8 @@ This analytic is to detect a suspicious command that may hijack a library functi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_preload_hijack_library_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md b/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md index c58ac363d4..e41cc28923 100644 --- a/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md +++ b/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md @@ -115,8 +115,8 @@ This analytic is to look for possible elevation control access using a common kn #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_common_process_for_elevation_control_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md b/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md index 0087e4ed82..61633cc0b9 100644 --- a/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md +++ b/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md @@ -115,8 +115,8 @@ This analytic is to looks for file creation of sudoers.tmp file cause by editing #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_sudoers_tmp_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md b/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md index 339e2ffa54..cdb6c7fd4b 100644 --- a/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md +++ b/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md @@ -115,8 +115,8 @@ This analytic is to detect the execution of sudo or su command in linux operatin #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_sudo_or_su_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md b/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md index 9eb88bf61d..d5b3d92b20 100644 --- a/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md +++ b/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md @@ -115,8 +115,8 @@ This analytic is to detect the creation of doas.conf file in linux host platform #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_doas_conf_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-05-linux_doas_tool_execution.md b/docs/_posts/2022-01-05-linux_doas_tool_execution.md index a322917bc6..2de453899f 100644 --- a/docs/_posts/2022-01-05-linux_doas_tool_execution.md +++ b/docs/_posts/2022-01-05-linux_doas_tool_execution.md @@ -115,8 +115,8 @@ This analytic is to detect the doas tool execution in linux host platform. This #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_doas_tool_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md b/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md index 9050778c1c..2aa11354c6 100644 --- a/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md +++ b/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md @@ -113,8 +113,8 @@ This analytic is to detect a possible attempt to dump or access the content of / #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_possible_access_to_credential_files_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md b/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md index 7a328f51ca..ccd0161f40 100644 --- a/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md +++ b/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md @@ -115,8 +115,8 @@ This analytic is to detect a possible access or modification of /etc/sudoers fil #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_possible_access_to_sudoers_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md b/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md index 3116f02ed4..7a3d71fcb8 100644 --- a/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md +++ b/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md @@ -113,8 +113,8 @@ This analytic is to look for suspicious process command-line that might be acces #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_possible_access_or_modification_of_sshd_config_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md b/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md index ee96e8edd4..e48b498599 100644 --- a/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md +++ b/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md @@ -113,8 +113,8 @@ This analytic is to look for possible ssh key file creation on ~/.ssh/ folder. T #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_possible_ssh_key_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md index a7e3a6be4d..442e364455 100644 --- a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md +++ b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md @@ -126,9 +126,9 @@ The following hunting analytic identifies PowerShell commands utilizing the Wind #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_-_connect_to_internet_with_hidden_window_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md index 1b41db59c0..1ba88bee28 100644 --- a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md +++ b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md @@ -108,9 +108,9 @@ The following analytic uses a pretrained machine learning text classifier to det #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [potentially_malicious_code_on_cmdline_tokenize_score](https://github.com/splunk/security_content/blob/develop/macros/potentially_malicious_code_on_cmdline_tokenize_score.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **potentially_malicious_code_on_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md index 65de741ab3..7cf91e628e 100644 --- a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md +++ b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md @@ -112,9 +112,9 @@ The following analytic identifies command-line arguments where `cmd.exe /c` is u #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **cmd_carry_out_string_command_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md b/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md index 202b1b4442..b88cdfc67f 100644 --- a/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md +++ b/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md @@ -123,8 +123,8 @@ This analytic looks for the presence of suspicious commandline parameters typica #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **impacket_lateral_movement_commandline_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md index f58ff3f639..799ee11de7 100644 --- a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md +++ b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md @@ -119,9 +119,9 @@ Alternatively, may use regex per matching here https://regexr.com/662ov. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **malicious_powershell_process_-_encoded_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md b/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md index 79d72396a3..a5c900d7f4 100644 --- a/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md +++ b/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md @@ -112,8 +112,8 @@ This analytic will identify a suspicious PowerShell command used to delete the W #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_remove_windows_defender_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md index 12c713a123..57a706f4f6 100644 --- a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md +++ b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md @@ -118,9 +118,9 @@ The following analytic identifies native .net binaries within the Windows operat #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [is_net_windows_file](https://github.com/splunk/security_content/blob/develop/macros/is_net_windows_file.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_dotnet_binary_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md index 14da8b3f81..921bf0c555 100644 --- a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md +++ b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md @@ -118,8 +118,8 @@ The following analytic identifies the Windows binary InstallUtil.exe running fro #### Macros The SPL above uses the following Macros: * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_installutil_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-20-ping_sleep_batch_command.md b/docs/_posts/2022-01-20-ping_sleep_batch_command.md index 548baa0f37..343ee79b70 100644 --- a/docs/_posts/2022-01-20-ping_sleep_batch_command.md +++ b/docs/_posts/2022-01-20-ping_sleep_batch_command.md @@ -115,9 +115,9 @@ This analytic will identify the possible execution of ping sleep batch commands. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_ping](https://github.com/splunk/security_content/blob/develop/macros/process_ping.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **ping_sleep_batch_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md b/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md index 63f965312e..3abf7bcc8b 100644 --- a/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md +++ b/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md @@ -102,8 +102,8 @@ The following analytic identifies the use of AdvancedRun.exe. AdvancedRun.exe ha #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_nirsoft_advancedrun_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md index 58eb298f76..5784a8b047 100644 --- a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md +++ b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md @@ -103,9 +103,9 @@ The following hunting analytic assists with identifying the proces execution of #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [is_nirsoft_software](https://github.com/splunk/security_content/blob/develop/macros/is_nirsoft_software.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_nirsoft_utilities_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md b/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md index 26e45f6eac..172fb5e898 100644 --- a/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md +++ b/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md @@ -121,8 +121,8 @@ This correlation find exploitation of Log4Shell CVE-2021-44228 against systems u #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **log4shell_cve-2021-44228_exploitation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md b/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md index b4d42dcb83..73f2bb9494 100644 --- a/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md +++ b/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md @@ -108,8 +108,8 @@ The following analytic identifies `pkexec` spawning with no command-line argumen #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_pkexec_privilege_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md b/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md index ea2831e11f..373aab455c 100644 --- a/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md +++ b/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md @@ -109,8 +109,8 @@ The following analytic looks for the use of Mimikatz command line parameters lev #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **mimikatz_passtheticket_commandline_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-01-rubeus_command_line_parameters.md b/docs/_posts/2022-02-01-rubeus_command_line_parameters.md index 1569f59492..db02fcdfb6 100644 --- a/docs/_posts/2022-02-01-rubeus_command_line_parameters.md +++ b/docs/_posts/2022-02-01-rubeus_command_line_parameters.md @@ -124,8 +124,8 @@ Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily ad #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **rubeus_command_line_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md index b0dc4c81af..b5b9d1279f 100644 --- a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md +++ b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md @@ -102,9 +102,9 @@ Certutil.exe may download a file from a remote destination using `-urlcache`. Th #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **certutil_download_with_urlcache_and_split_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md index 9d1509047e..ccb7fb58d6 100644 --- a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md +++ b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md @@ -102,9 +102,9 @@ Certutil.exe may download a file from a remote destination using `-VerifyCtl`. T #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **certutil_download_with_verifyctl_and_split_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-03-o365_added_service_principal.md b/docs/_posts/2022-02-03-o365_added_service_principal.md index 675f3abf1c..af277a65bb 100644 --- a/docs/_posts/2022-02-03-o365_added_service_principal.md +++ b/docs/_posts/2022-02-03-o365_added_service_principal.md @@ -105,8 +105,8 @@ This search detects the creation of a new Federation setting by alerting about a #### Macros The SPL above uses the following Macros: -* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) > :information_source: > **o365_added_service_principal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md b/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md index 861cd2db17..250614bfde 100644 --- a/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md +++ b/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md @@ -110,8 +110,8 @@ This search detects newly added IP addresses/CIDR blocks to the list of MFA Trus #### Macros The SPL above uses the following Macros: -* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) > :information_source: > **o365_bypass_mfa_via_trusted_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-03-o365_disable_mfa.md b/docs/_posts/2022-02-03-o365_disable_mfa.md index c8571f10e9..7dc316494e 100644 --- a/docs/_posts/2022-02-03-o365_disable_mfa.md +++ b/docs/_posts/2022-02-03-o365_disable_mfa.md @@ -102,8 +102,8 @@ This search detects when multi factor authentication has been disabled, what ent #### Macros The SPL above uses the following Macros: -* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) > :information_source: > **o365_disable_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md index 250e164d6a..50d97d6377 100644 --- a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md +++ b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md @@ -103,9 +103,9 @@ The following analytic identifies the use of Microsoft Remote Assistance, msra.e #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_remote_assistance_spawning_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md index 16d1ce75e5..5f804c74bc 100644 --- a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md +++ b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md @@ -111,9 +111,9 @@ The following analytic identifies Schtasks.exe creating a new task to start and #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_schtasks](https://github.com/splunk/security_content/blob/develop/macros/process_schtasks.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_schtasks_create_run_as_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md index 7722a45d94..fdd002a3da 100644 --- a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md +++ b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md @@ -113,9 +113,9 @@ The following analytic identifies rundll32.exe loading an export function by ord #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **rundll_loading_dll_by_ordinal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md b/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md index 8ebe56389a..50528a4b61 100644 --- a/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md +++ b/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md @@ -110,8 +110,8 @@ The following analytic leverages Kerberos Event 4769, A Kerberos service ticket #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **kerberoasting_spn_request_with_rc4_encryption_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-14-linux_dd_file_overwrite.md b/docs/_posts/2022-02-14-linux_dd_file_overwrite.md index 0cfb7e786f..f986444057 100644 --- a/docs/_posts/2022-02-14-linux_dd_file_overwrite.md +++ b/docs/_posts/2022-02-14-linux_dd_file_overwrite.md @@ -108,8 +108,8 @@ This analytic is to look for dd command to overwrite file. This technique was ab #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_dd_file_overwrite_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md index ff5d46003c..08a81b3c4c 100644 --- a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md +++ b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md @@ -106,9 +106,9 @@ DiskShadow.exe is a Microsoft Signed binary present on Windows Server. It has a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_diskshadow](https://github.com/splunk/security_content/blob/develop/macros/process_diskshadow.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_diskshadow_proxy_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md b/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md index bba5c4564b..8d5900fd32 100644 --- a/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md +++ b/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md @@ -114,8 +114,8 @@ The following analytic identifies the Windows Windows Remote Auto Dialer, rasaut #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_rasautou_dll_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md b/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md index 3c247d1e0f..22d141bf26 100644 --- a/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md +++ b/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **disabled_kerberos_pre-authentication_discovery_with_powerview_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-net_profiler_uac_bypass.md b/docs/_posts/2022-02-18-net_profiler_uac_bypass.md index 1cf612c716..4ee6ea7a4a 100644 --- a/docs/_posts/2022-02-18-net_profiler_uac_bypass.md +++ b/docs/_posts/2022-02-18-net_profiler_uac_bypass.md @@ -109,8 +109,8 @@ This search is to detect modification of registry to bypass UAC windows feature. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **net_profiler_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md b/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md index 9552bd6766..37dfa77e2e 100644 --- a/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md +++ b/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md @@ -101,8 +101,8 @@ This search detects when an excessive number of authentication failures occur th #### Macros The SPL above uses the following Macros: -* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) > :information_source: > **o365_excessive_authentication_failures_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md b/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md index 13c28723df..f9ccc2a3bb 100644 --- a/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md +++ b/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md @@ -113,8 +113,8 @@ Monitor for changes of the ExecutionPolicy in the registry to the values "unrest #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md b/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md index 2b99704f67..60219a7987 100644 --- a/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md +++ b/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **disabled_kerberos_pre-authentication_discovery_with_get-aduser_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md b/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md index 8c5011facc..fd63b65fa0 100644 --- a/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md +++ b/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md @@ -115,8 +115,8 @@ The following analytic identifies the creation or deletion of a scheduled task u #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **scheduled_task_deleted_or_created_via_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md index 354377901f..eaff2cd6b9 100644 --- a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md +++ b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md @@ -108,9 +108,9 @@ This analytic is to look for wmi commandlines to execute or create process. This #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_wmi_process_call_create_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md b/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md index 0fa7e197b5..46b18ec802 100644 --- a/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md +++ b/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md @@ -113,8 +113,8 @@ This analytic will identify suspicious excessive number of system events of serv #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **windows_excessive_disabled_services_event_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md b/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md index e336a11827..ac188f0ae5 100644 --- a/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md +++ b/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md @@ -109,8 +109,8 @@ This analytic is to look for process commandline that contains named pipe. This #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_process_with_namedpipe_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md b/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md index 7c5c0a2b02..87dfcd6ea1 100644 --- a/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md +++ b/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md @@ -114,8 +114,8 @@ This analytic is to look for suspicious file creation in the critical folder lik #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_file_without_extension_in_critical_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md b/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md index 74b80bc8eb..574b009b8e 100644 --- a/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md +++ b/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md @@ -103,8 +103,8 @@ This analytic will identify suspicious series of process executions. We have ob #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **excessive_distinct_processes_from_windows_temp_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-03-aws_createaccesskey.md b/docs/_posts/2022-03-03-aws_createaccesskey.md index fba90e0cfb..202202dd2d 100644 --- a/docs/_posts/2022-03-03-aws_createaccesskey.md +++ b/docs/_posts/2022-03-03-aws_createaccesskey.md @@ -113,8 +113,8 @@ This search looks for AWS CloudTrail events where a user A who has already permi #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **aws_createaccesskey_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-03-aws_updateloginprofile.md b/docs/_posts/2022-03-03-aws_updateloginprofile.md index d293eae63f..971235e801 100644 --- a/docs/_posts/2022-03-03-aws_updateloginprofile.md +++ b/docs/_posts/2022-03-03-aws_updateloginprofile.md @@ -113,8 +113,8 @@ This search looks for AWS CloudTrail events where a user A who has already permi #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **aws_updateloginprofile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-04-macos_lolbin.md b/docs/_posts/2022-03-04-macos_lolbin.md index 94c82a2200..2d6f2c8949 100644 --- a/docs/_posts/2022-03-04-macos_lolbin.md +++ b/docs/_posts/2022-03-04-macos_lolbin.md @@ -115,8 +115,8 @@ Detect multiple executions of Living off the Land (LOLbin) binaries in a short p #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [osquery](https://github.com/splunk/security_content/blob/develop/macros/osquery.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **macos_lolbin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-08-suspicious_msbuild_path.md b/docs/_posts/2022-03-08-suspicious_msbuild_path.md index ea72828393..2f99e22370 100644 --- a/docs/_posts/2022-03-08-suspicious_msbuild_path.md +++ b/docs/_posts/2022-03-08-suspicious_msbuild_path.md @@ -122,9 +122,9 @@ The following analytic identifies msbuild.exe executing from a non-standard path #### Macros The SPL above uses the following Macros: -* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) > :information_source: > **suspicious_msbuild_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md b/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md index ccc0b8dbdc..f693985285 100644 --- a/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md +++ b/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md @@ -108,8 +108,8 @@ The following analytic identifies a process performing an outbound connection on #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **unknown_process_using_the_kerberos_protocol_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md index b442efd626..a34980db99 100644 --- a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md @@ -113,9 +113,9 @@ The following analytic identifies regasm.exe with no command line arguments. Thi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_regasm](https://github.com/splunk/security_content/blob/develop/macros/process_regasm.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_regasm_with_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md index 2a33a397b7..7451a3e1bf 100644 --- a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md @@ -113,9 +113,9 @@ The following analytic identifies regsvcs.exe with no command line arguments. Th #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_regsvcs](https://github.com/splunk/security_content/blob/develop/macros/process_regsvcs.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_regsvcs_with_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md index ffbc1a4619..2706545141 100644 --- a/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md +++ b/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md @@ -109,8 +109,8 @@ The following analytic identifies DLLHost.exe with no command line arguments wit #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **dllhost_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md index fbbfcbeb5a..8b321bdcbb 100644 --- a/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md +++ b/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md @@ -109,8 +109,8 @@ The following analytic identifies gpupdate.exe with no command line arguments an #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **gpupdate_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md b/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md index 2b4295dc4f..54d27c0615 100644 --- a/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md +++ b/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md @@ -105,8 +105,8 @@ The following analytic leverages Kerberos Event 4769, A Kerberos service ticket #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **kerberos_service_ticket_request_using_rc4_encryption_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md index d59dbdf38a..7423684416 100644 --- a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md +++ b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md @@ -118,9 +118,9 @@ The following analytic identifies rundll32.exe with no command line arguments an #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **rundll32_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md b/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md index 5c333ca65b..324e1c458c 100644 --- a/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md +++ b/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md @@ -109,8 +109,8 @@ The following analytic identifies searchprotocolhost.exe with no command line ar #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **searchprotocolhost_with_no_command_line_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md index c5fb8b3ffa..3a31fcf9ff 100644 --- a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md @@ -104,9 +104,9 @@ The following analytic identifies DLLHost.exe with no command line arguments. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_dllhost](https://github.com/splunk/security_content/blob/develop/macros/process_dllhost.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_dllhost_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md index d7e6ff4188..006012ac4d 100644 --- a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md @@ -104,9 +104,9 @@ The following analytic identifies gpupdate.exe with no command line arguments. I #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_gpupdate](https://github.com/splunk/security_content/blob/develop/macros/process_gpupdate.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_gpupdate_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md index 933a8cb6fc..5dc93741a3 100644 --- a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md @@ -118,9 +118,9 @@ The following analytic identifies rundll32.exe with no command line arguments. I #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_rundll32_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md index 6c75b14d70..d943755167 100644 --- a/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md @@ -104,8 +104,8 @@ The following analytic identifies searchprotocolhost.exe with no command line ar #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_searchprotocolhost_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md index f012129af1..02546a0eed 100644 --- a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md +++ b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md @@ -116,8 +116,8 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_installutil_remote_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md index 5204d6ee21..4eba7529a2 100644 --- a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md +++ b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md @@ -117,8 +117,8 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_installutil_uninstall_option_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md b/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md index 248502084b..68b0b97869 100644 --- a/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md +++ b/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md @@ -102,8 +102,8 @@ This analytic identifies suspicious modification of ACL permission to a files or #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **modify_acl_permission_to_files_or_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2022-03-22-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md index 74f5f965b3..b92d9ede9a 100644 --- a/docs/_posts/2022-03-22-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md @@ -100,8 +100,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-get_domainuser_with_powershell_script_block.md b/docs/_posts/2022-03-22-get_domainuser_with_powershell_script_block.md index da5c5a0d7a..6537929b66 100644 --- a/docs/_posts/2022-03-22-get_domainuser_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-get_domainuser_with_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **get_domainuser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-get_wmiobject_group_discovery_with_script_block_logging.md b/docs/_posts/2022-03-22-get_wmiobject_group_discovery_with_script_block_logging.md index 3b0d03259d..bc2cd769f7 100644 --- a/docs/_posts/2022-03-22-get_wmiobject_group_discovery_with_script_block_logging.md +++ b/docs/_posts/2022-03-22-get_wmiobject_group_discovery_with_script_block_logging.md @@ -107,8 +107,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **get_wmiobject_group_discovery_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-getadgroup_with_powershell_script_block.md b/docs/_posts/2022-03-22-getadgroup_with_powershell_script_block.md index d41c63b039..2f98054adc 100644 --- a/docs/_posts/2022-03-22-getadgroup_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-getadgroup_with_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getadgroup_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-getcurrent_user_with_powershell_script_block.md b/docs/_posts/2022-03-22-getcurrent_user_with_powershell_script_block.md index 7360d8b806..a17ba7e26e 100644 --- a/docs/_posts/2022-03-22-getcurrent_user_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-getcurrent_user_with_powershell_script_block.md @@ -100,8 +100,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getcurrent_user_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md b/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md index fce94f7e8c..852b9be36e 100644 --- a/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getlocaluser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-interactive_session_on_remote_endpoint_with_powershell.md b/docs/_posts/2022-03-22-interactive_session_on_remote_endpoint_with_powershell.md index 794c52a432..6b739035e2 100644 --- a/docs/_posts/2022-03-22-interactive_session_on_remote_endpoint_with_powershell.md +++ b/docs/_posts/2022-03-22-interactive_session_on_remote_endpoint_with_powershell.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **interactive_session_on_remote_endpoint_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-kerberos_pre-authentication_flag_disabled_with_powershell.md b/docs/_posts/2022-03-22-kerberos_pre-authentication_flag_disabled_with_powershell.md index 1dbda3af81..ae8a733c0f 100644 --- a/docs/_posts/2022-03-22-kerberos_pre-authentication_flag_disabled_with_powershell.md +++ b/docs/_posts/2022-03-22-kerberos_pre-authentication_flag_disabled_with_powershell.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **kerberos_pre-authentication_flag_disabled_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-powershell_execute_com_object.md b/docs/_posts/2022-03-22-powershell_execute_com_object.md index 18ed9ef03a..812e504e80 100644 --- a/docs/_posts/2022-03-22-powershell_execute_com_object.md +++ b/docs/_posts/2022-03-22-powershell_execute_com_object.md @@ -108,8 +108,8 @@ This search is to detect a COM CLSID execution through powershell. This techniqu #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_execute_com_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md b/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md index 86b61d0868..f1e1f53671 100644 --- a/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md +++ b/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md @@ -105,8 +105,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_using_memory_as_backing_store_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md b/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md index 41ca8c1dbb..4b2f95e35b 100644 --- a/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md +++ b/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md @@ -100,8 +100,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **recon_avproduct_through_pwh_or_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-remote_process_instantiation_via_dcom_and_powershell_script_block.md b/docs/_posts/2022-03-22-remote_process_instantiation_via_dcom_and_powershell_script_block.md index 669000fd6a..d1a7fe8c0b 100644 --- a/docs/_posts/2022-03-22-remote_process_instantiation_via_dcom_and_powershell_script_block.md +++ b/docs/_posts/2022-03-22-remote_process_instantiation_via_dcom_and_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **remote_process_instantiation_via_dcom_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md b/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md index e285770d5e..b98a1b1544 100644 --- a/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md +++ b/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **remote_process_instantiation_via_winrm_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-user_discovery_with_env_vars_powershell_script_block.md b/docs/_posts/2022-03-22-user_discovery_with_env_vars_powershell_script_block.md index c4cca2d7ac..b3eca55344 100644 --- a/docs/_posts/2022-03-22-user_discovery_with_env_vars_powershell_script_block.md +++ b/docs/_posts/2022-03-22-user_discovery_with_env_vars_powershell_script_block.md @@ -100,8 +100,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **user_discovery_with_env_vars_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-28-windows_get-adcomputer_unconstrained_delegation_discovery.md b/docs/_posts/2022-03-28-windows_get-adcomputer_unconstrained_delegation_discovery.md index 5b961d19a5..a3aedd0f60 100644 --- a/docs/_posts/2022-03-28-windows_get-adcomputer_unconstrained_delegation_discovery.md +++ b/docs/_posts/2022-03-28-windows_get-adcomputer_unconstrained_delegation_discovery.md @@ -106,8 +106,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **windows_get-adcomputer_unconstrained_delegation_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-28-windows_powerview_unconstrained_delegation_discovery.md b/docs/_posts/2022-03-28-windows_powerview_unconstrained_delegation_discovery.md index 3864819c70..bf1b12c71f 100644 --- a/docs/_posts/2022-03-28-windows_powerview_unconstrained_delegation_discovery.md +++ b/docs/_posts/2022-03-28-windows_powerview_unconstrained_delegation_discovery.md @@ -106,8 +106,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **windows_powerview_unconstrained_delegation_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md b/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md index d6a31df127..9ae2aae28d 100644 --- a/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md +++ b/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md @@ -123,8 +123,8 @@ The following analytic identifies the use of a delivered ISO file that has been #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_iso_lnk_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-31-windows_powerview_constrained_delegation_discovery.md b/docs/_posts/2022-03-31-windows_powerview_constrained_delegation_discovery.md index 7273292702..55aa0881cd 100644 --- a/docs/_posts/2022-03-31-windows_powerview_constrained_delegation_discovery.md +++ b/docs/_posts/2022-03-31-windows_powerview_constrained_delegation_discovery.md @@ -106,8 +106,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **windows_powerview_constrained_delegation_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md b/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md index a49622fd78..e8bf097fdc 100644 --- a/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md +++ b/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md @@ -107,8 +107,8 @@ The following analytic uses Windows EventCode 7045 to identify new Kernel Mode D #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **windows_driver_load_non-standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-04-windows_event_for_service_disabled.md b/docs/_posts/2022-04-04-windows_event_for_service_disabled.md index ba8933f81a..5d7224b035 100644 --- a/docs/_posts/2022-04-04-windows_event_for_service_disabled.md +++ b/docs/_posts/2022-04-04-windows_event_for_service_disabled.md @@ -112,8 +112,8 @@ This analytic will identify suspicious system event of services that was modifie #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **windows_event_for_service_disabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-05-java_writing_jsp_file.md b/docs/_posts/2022-04-05-java_writing_jsp_file.md index a77e0be6c5..c33802b2bf 100644 --- a/docs/_posts/2022-04-05-java_writing_jsp_file.md +++ b/docs/_posts/2022-04-05-java_writing_jsp_file.md @@ -118,8 +118,8 @@ The following analytic identifies the process java writing a .jsp to disk. This #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **java_writing_jsp_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md b/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md index 20a44c84b6..16035560b4 100644 --- a/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md +++ b/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md @@ -115,8 +115,8 @@ This analytic looks for suspicious commandline that redirect the stdout or possi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_stdout_redirection_to_dev_null_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md index 0393e4c84c..acd9989556 100644 --- a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md +++ b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md @@ -107,8 +107,8 @@ The following analytic detects programs that have been started by forfiles.exe. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_indirect_command_execution_via_forfiles_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md index 89de9e7418..f7e1be5907 100644 --- a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md +++ b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md @@ -107,8 +107,8 @@ The following analytic detects programs that have been started by pcalua.exe. pc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_indirect_command_execution_via_pcalua_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md b/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md index d73eeffe74..aa65234c4a 100644 --- a/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md +++ b/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md @@ -113,8 +113,8 @@ The following analytic identifies the payload related to Spring4Shell, CVE-2022- #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **web_spring4shell_http_request_class_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-any_powershell_downloadfile.md b/docs/_posts/2022-04-07-any_powershell_downloadfile.md index 329d185ff5..65acb4e0a0 100644 --- a/docs/_posts/2022-04-07-any_powershell_downloadfile.md +++ b/docs/_posts/2022-04-07-any_powershell_downloadfile.md @@ -117,9 +117,9 @@ The following analytic identifies the use of PowerShell downloading a file using #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **any_powershell_downloadfile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-any_powershell_downloadstring.md b/docs/_posts/2022-04-07-any_powershell_downloadstring.md index 4ed02b76f5..6f2c3f2caa 100644 --- a/docs/_posts/2022-04-07-any_powershell_downloadstring.md +++ b/docs/_posts/2022-04-07-any_powershell_downloadstring.md @@ -112,9 +112,9 @@ The following analytic identifies the use of PowerShell downloading a file using #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **any_powershell_downloadstring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-detect_html_help_renamed.md b/docs/_posts/2022-04-07-detect_html_help_renamed.md index 6acb966621..2c83977abd 100644 --- a/docs/_posts/2022-04-07-detect_html_help_renamed.md +++ b/docs/_posts/2022-04-07-detect_html_help_renamed.md @@ -112,8 +112,8 @@ The following analytic identifies a renamed instance of hh.exe (HTML Help) execu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_html_help_renamed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-detect_mshta_renamed.md b/docs/_posts/2022-04-07-detect_mshta_renamed.md index 6c7bb3deb7..bd17b43c17 100644 --- a/docs/_posts/2022-04-07-detect_mshta_renamed.md +++ b/docs/_posts/2022-04-07-detect_mshta_renamed.md @@ -112,8 +112,8 @@ The following analytic identifies renamed instances of mshta.exe executing. Msht #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_mshta_renamed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-detect_renamed_psexec.md b/docs/_posts/2022-04-07-detect_renamed_psexec.md index db349684ac..e8daa0b410 100644 --- a/docs/_posts/2022-04-07-detect_renamed_psexec.md +++ b/docs/_posts/2022-04-07-detect_renamed_psexec.md @@ -107,8 +107,8 @@ The following analytic identifies renamed instances of `PsExec.exe` being utiliz #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_renamed_psexec_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md b/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md index 8a944454e2..6787b99a3d 100644 --- a/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md +++ b/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md @@ -117,8 +117,8 @@ The following analytic identifies a renamed instance of microsoft.workflow.compi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_microsoft_workflow_compiler_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-suspicious_msbuild_rename.md b/docs/_posts/2022-04-07-suspicious_msbuild_rename.md index c2a68c2137..65148f9078 100644 --- a/docs/_posts/2022-04-07-suspicious_msbuild_rename.md +++ b/docs/_posts/2022-04-07-suspicious_msbuild_rename.md @@ -122,8 +122,8 @@ The following analytic identifies renamed instances of msbuild.exe executing. Ms #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_msbuild_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-suspicious_rundll32_rename.md b/docs/_posts/2022-04-07-suspicious_rundll32_rename.md index ac99111818..07abd6388f 100644 --- a/docs/_posts/2022-04-07-suspicious_rundll32_rename.md +++ b/docs/_posts/2022-04-07-suspicious_rundll32_rename.md @@ -122,8 +122,8 @@ The following hunting analytic identifies renamed instances of rundll32.exe exec #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_rundll32_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md b/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md index 12f96affcf..886e74fc2b 100644 --- a/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md +++ b/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md @@ -115,8 +115,8 @@ The following analytic identifies a process attempting to delete a scheduled tas #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_registry_delete_task_sd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md b/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md index 4502ff62f6..61b922223d 100644 --- a/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md +++ b/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md @@ -107,9 +107,9 @@ This search looks for the execution of `nltest.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_nltest](https://github.com/splunk/security_content/blob/develop/macros/process_nltest.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **nltest_domain_trust_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-22-linux_adding_crontab_using_list_parameter.md b/docs/_posts/2022-04-22-linux_adding_crontab_using_list_parameter.md index c2a8c673ef..0d89850005 100644 --- a/docs/_posts/2022-04-22-linux_adding_crontab_using_list_parameter.md +++ b/docs/_posts/2022-04-22-linux_adding_crontab_using_list_parameter.md @@ -117,8 +117,8 @@ The following analytic identifies a suspicious cron jobs modification using cron #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_adding_crontab_using_list_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-22-linux_deleting_critical_directory_using_rm_command.md b/docs/_posts/2022-04-22-linux_deleting_critical_directory_using_rm_command.md index f5f77d7472..7df59fa8ee 100644 --- a/docs/_posts/2022-04-22-linux_deleting_critical_directory_using_rm_command.md +++ b/docs/_posts/2022-04-22-linux_deleting_critical_directory_using_rm_command.md @@ -108,8 +108,8 @@ The following analytic identifies a suspicious deletion of a critical folder in #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_deleting_critical_directory_using_rm_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-22-linux_disable_services.md b/docs/_posts/2022-04-22-linux_disable_services.md index d099ecf726..511db970ed 100644 --- a/docs/_posts/2022-04-22-linux_disable_services.md +++ b/docs/_posts/2022-04-22-linux_disable_services.md @@ -108,8 +108,8 @@ The following analytic is to detect events that attempts to disable a service. T #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_disable_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-22-linux_shred_overwrite_command.md b/docs/_posts/2022-04-22-linux_shred_overwrite_command.md index f1c6a95dc1..c0e42b6493 100644 --- a/docs/_posts/2022-04-22-linux_shred_overwrite_command.md +++ b/docs/_posts/2022-04-22-linux_shred_overwrite_command.md @@ -108,8 +108,8 @@ This analytic is to detect a shred process to overwrite a files in a linux machi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_shred_overwrite_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-22-linux_stop_services.md b/docs/_posts/2022-04-22-linux_stop_services.md index f9ba9a7b71..9c2404013c 100644 --- a/docs/_posts/2022-04-22-linux_stop_services.md +++ b/docs/_posts/2022-04-22-linux_stop_services.md @@ -108,8 +108,8 @@ The following analytic is to detect events that attempt to stop or clear a servi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_stop_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-25-windows_linked_policies_in_adsi_discovery.md b/docs/_posts/2022-04-25-windows_linked_policies_in_adsi_discovery.md index 34af68501f..70fa0e4f3f 100644 --- a/docs/_posts/2022-04-25-windows_linked_policies_in_adsi_discovery.md +++ b/docs/_posts/2022-04-25-windows_linked_policies_in_adsi_discovery.md @@ -112,8 +112,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **windows_linked_policies_in_adsi_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-25-windows_root_domain_linked_policies_discovery.md b/docs/_posts/2022-04-25-windows_root_domain_linked_policies_discovery.md index db7c76d204..dc17c69bb6 100644 --- a/docs/_posts/2022-04-25-windows_root_domain_linked_policies_discovery.md +++ b/docs/_posts/2022-04-25-windows_root_domain_linked_policies_discovery.md @@ -112,8 +112,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **windows_root_domain_linked_policies_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md b/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md index 41c9d503c8..78de749e75 100644 --- a/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md +++ b/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md @@ -111,8 +111,8 @@ The following query utilizes Windows Security EventCode 4698, A scheduled task w #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_hidden_schedule_task_settings_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md b/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md index 0716084d03..2c0de92432 100644 --- a/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md +++ b/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md @@ -107,8 +107,8 @@ The following analytic identifes a Computer Account creating a new Computer Acco #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_computer_account_created_by_computer_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md b/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md index 6508556aaa..b5599f262c 100644 --- a/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md +++ b/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md @@ -107,8 +107,8 @@ The following analytic identifies a ComputerAccount requesting a Kerberos Ticket #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_computer_account_requesting_kerberos_ticket_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md b/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md index 3d6baf3523..8801b6f266 100644 --- a/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md +++ b/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md @@ -107,8 +107,8 @@ The following analytic identifies a local successful authentication event on a W #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_kerberos_local_successful_logon_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-28-windows_computer_account_with_spn.md b/docs/_posts/2022-04-28-windows_computer_account_with_spn.md index 7c459b8206..82539a9f8d 100644 --- a/docs/_posts/2022-04-28-windows_computer_account_with_spn.md +++ b/docs/_posts/2022-04-28-windows_computer_account_with_spn.md @@ -109,8 +109,8 @@ The following analytic identifies two SPNs, HOST and RestrictedKrbHost, added us #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_computer_account_with_spn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-30-linux_iptables_firewall_modification.md b/docs/_posts/2022-04-30-linux_iptables_firewall_modification.md index f23bcdfdec..e4d8947e32 100644 --- a/docs/_posts/2022-04-30-linux_iptables_firewall_modification.md +++ b/docs/_posts/2022-04-30-linux_iptables_firewall_modification.md @@ -121,8 +121,8 @@ This analytic looks for suspicious commandline that modify the iptables firewall #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_iptables_firewall_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md b/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md index 81557141a0..6a402c09d2 100644 --- a/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md +++ b/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md @@ -113,8 +113,8 @@ This analytic looks for suspicious process kworker commandline in a linux machin #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_kworker_process_in_writable_process_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md b/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md index 50bd382f02..197ec18a1a 100644 --- a/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md +++ b/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md @@ -108,8 +108,8 @@ The following analytic identifies the default service name created by KrbRelayUp #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **windows_krbrelayup_service_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-05-windows_service_create_kernel_mode_driver.md b/docs/_posts/2022-05-05-windows_service_create_kernel_mode_driver.md index 7127c9061b..f52fd0bab9 100644 --- a/docs/_posts/2022-05-05-windows_service_create_kernel_mode_driver.md +++ b/docs/_posts/2022-05-05-windows_service_create_kernel_mode_driver.md @@ -120,8 +120,8 @@ The following analytic identifes a new kernel driver being added to Windows usin #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_service_create_kernel_mode_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-16-windows_system_file_on_disk.md b/docs/_posts/2022-05-16-windows_system_file_on_disk.md index a4469a0c63..10dde422ad 100644 --- a/docs/_posts/2022-05-16-windows_system_file_on_disk.md +++ b/docs/_posts/2022-05-16-windows_system_file_on_disk.md @@ -108,8 +108,8 @@ The following hunting analytic will assist with identifying new .sys files intro #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_system_file_on_disk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-17-aws_create_policy_version_to_allow_all_resources.md b/docs/_posts/2022-05-17-aws_create_policy_version_to_allow_all_resources.md index 1120aa4fd0..09ba5d8beb 100644 --- a/docs/_posts/2022-05-17-aws_create_policy_version_to_allow_all_resources.md +++ b/docs/_posts/2022-05-17-aws_create_policy_version_to_allow_all_resources.md @@ -121,8 +121,8 @@ This search looks for AWS CloudTrail events where a user created a policy versio #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **aws_create_policy_version_to_allow_all_resources_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-23-schtasks_scheduling_job_on_remote_system.md b/docs/_posts/2022-05-23-schtasks_scheduling_job_on_remote_system.md index faa65f5472..e14e37df10 100644 --- a/docs/_posts/2022-05-23-schtasks_scheduling_job_on_remote_system.md +++ b/docs/_posts/2022-05-23-schtasks_scheduling_job_on_remote_system.md @@ -115,8 +115,8 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **schtasks_scheduling_job_on_remote_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-26-linux_at_application_execution.md b/docs/_posts/2022-05-26-linux_at_application_execution.md index 6ab7c3618b..d4d3ae7e0d 100644 --- a/docs/_posts/2022-05-26-linux_at_application_execution.md +++ b/docs/_posts/2022-05-26-linux_at_application_execution.md @@ -117,8 +117,8 @@ The following analytic identifies a suspicious process creation of At applicatio #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_at_application_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-26-linux_possible_append_command_to_at_allow_config_file.md b/docs/_posts/2022-05-26-linux_possible_append_command_to_at_allow_config_file.md index 460b2cc15f..225f6cd674 100644 --- a/docs/_posts/2022-05-26-linux_possible_append_command_to_at_allow_config_file.md +++ b/docs/_posts/2022-05-26-linux_possible_append_command_to_at_allow_config_file.md @@ -117,8 +117,8 @@ This analytic looks for suspicious commandline that may use to append user entry #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **linux_possible_append_command_to_at_allow_config_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-26-macos_plutil.md b/docs/_posts/2022-05-26-macos_plutil.md index 9d7140b763..cb78981f6e 100644 --- a/docs/_posts/2022-05-26-macos_plutil.md +++ b/docs/_posts/2022-05-26-macos_plutil.md @@ -109,8 +109,8 @@ Detect usage of plutil to modify plist files. Adversaries can modiy plist files #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [osquery](https://github.com/splunk/security_content/blob/develop/macros/osquery.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **macos_plutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-30-windows_command_and_scripting_interpreter_path_traversal_exec.md b/docs/_posts/2022-05-30-windows_command_and_scripting_interpreter_path_traversal_exec.md new file mode 100644 index 0000000000..3ee32e08b9 --- /dev/null +++ b/docs/_posts/2022-05-30-windows_command_and_scripting_interpreter_path_traversal_exec.md @@ -0,0 +1,170 @@ +--- +title: "Windows Command and Scripting Interpreter Path Traversal Exec" +excerpt: "Command and Scripting Interpreter +" +categories: + - Endpoint +last_modified_at: 2022-05-30 +toc: true +toc_label: "" +tags: + - Command and Scripting Interpreter + - Execution + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies path traversal commandline execution. This technique was seen in malicious document that execute malicious code using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and commandline that runs before and after this execution. This may help you to find possible downloaded malware or other lolbin execution. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-05-30 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 58fcdeb1-728d-415d-b0d7-3ab18a275ec2 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*\/..\/..\/..\/..\/..\/..\/..\/..\/..\/*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash +| `drop_dm_object_name("Processes")` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `windows_command_and_scripting_interpreter_path_traversal_exec_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) + +> :information_source: +> **windows_command_and_scripting_interpreter_path_traversal_exec_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product + +#### Known False Positives +Not known at this moment. + +#### Associated Analytic story +* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics) +* [Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190](/stories/microsoft_support_diagnostic_tool_vulnerability_cve-2022-30190) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 90.0 | 90 | 100 | A parent process $parent_process_name$ has spawned a child $process_name$ with path traversal commandline $process$ in $dest$ | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/](https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/path_traversal/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/path_traversal/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-05-30-windows_execute_arbitrary_commands_with_msdt.md b/docs/_posts/2022-05-30-windows_execute_arbitrary_commands_with_msdt.md new file mode 100644 index 0000000000..abbd61b6f5 --- /dev/null +++ b/docs/_posts/2022-05-30-windows_execute_arbitrary_commands_with_msdt.md @@ -0,0 +1,179 @@ +--- +title: "Windows Execute Arbitrary Commands with MSDT" +excerpt: "Indirect Command Execution +" +categories: + - Endpoint +last_modified_at: 2022-05-30 +toc: true +toc_label: "" +tags: + - Indirect Command Execution + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies a recently disclosed arbitraty command execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve a remote payload. During triage, review file modifications for html. Identify parallel process execution that may be related, including an Office Product. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-05-30 +- **Author**: Michael Haag, Teoderick Contreras, Splunk +- **ID**: e1d5145f-38fe-42b9-a5d5-457796715f97 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1202](https://attack.mitre.org/techniques/T1202/) | Indirect Command Execution | Defense Evasion | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [](https://nvd.nist.gov/vuln/detail/) | | | + + + +
+
+ +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msdt.exe Processes.process="*ms-msdt:/id*" Processes.process="*IT_BrowseForFile=*" Processes.process="*IT_RebrowseForFile=*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `windows_execute_arbitrary_commands_with_msdt_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) + +> :information_source: +> **windows_execute_arbitrary_commands_with_msdt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Known False Positives +False positives may be present, filter as needed. + +#### Associated Analytic story +* [Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190](/stories/microsoft_support_diagnostic_tool_vulnerability_cve-2022-30190) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 100.0 | 100 | 100 | A parent process $parent_process_name$ has spawned a child process $process_name$ on host $dest$ possibly indicative of indirect command execution. | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://isc.sans.edu/diary/rss/28694](https://isc.sans.edu/diary/rss/28694) +* [https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e](https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e) +* [https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A](https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A) +* [https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/](https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/) +* [https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection](https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection) +* [https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html](https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-05-30-windows_office_product_spawning_msdt.md b/docs/_posts/2022-05-30-windows_office_product_spawning_msdt.md new file mode 100644 index 0000000000..3be85ab734 --- /dev/null +++ b/docs/_posts/2022-05-30-windows_office_product_spawning_msdt.md @@ -0,0 +1,185 @@ +--- +title: "Windows Office Product Spawning MSDT" +excerpt: "Phishing +, Spearphishing Attachment +" +categories: + - Endpoint +last_modified_at: 2022-05-30 +toc: true +toc_label: "" +tags: + - Phishing + - Spearphishing Attachment + - Initial Access + - Initial Access + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies a Microsoft Office product spawning the Windows msdt.exe process. MSDT is a Diagnostics Troubleshooting Wizard native to Windows. This behavior is related to a recently identified sample utilizing protocol handlers to evade preventative controls, including if macros are disabled in the document. During triage, review file modifications for html. In addition, parallel processes including PowerShell and CertUtil. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-05-30 +- **Author**: Michael Haag, Teoderick Contreras, Splunk +- **ID**: 127eba64-c981-40bf-8589-1830638864a7 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + +| [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [](https://nvd.nist.gov/vuln/detail/) | | | + + + +
+
+ +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","outlook.exe","mspub.exe","visio.exe") Processes.process_name=msdt.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `windows_office_product_spawning_msdt_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) + +> :information_source: +> **windows_office_product_spawning_msdt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id + + +#### How To Implement +how To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Known False Positives +False positives should be limited, however filter as needed. + +#### Associated Analytic story +* [Spearphishing Attachments](/stories/spearphishing_attachments) +* [Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190](/stories/microsoft_support_diagnostic_tool_vulnerability_cve-2022-30190) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 100.0 | 100 | 100 | Office parent process $parent_process_name$ has spawned a child process $process_name$ on host $dest$. | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://isc.sans.edu/diary/rss/28694](https://isc.sans.edu/diary/rss/28694) +* [https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e](https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e) +* [https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A](https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A) +* [https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/](https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/) +* [https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection](https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection) +* [https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html](https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_office_product_spawning_msdt.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_stories/microsoft_support_diagnostic_tool_vulnerability_cve-2022-30190.md b/docs/_stories/microsoft_support_diagnostic_tool_vulnerability_cve-2022-30190.md new file mode 100644 index 0000000000..ee3900d3bb --- /dev/null +++ b/docs/_stories/microsoft_support_diagnostic_tool_vulnerability_cve-2022-30190.md @@ -0,0 +1,50 @@ +--- +title: "Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190" +last_modified_at: 2022-05-31 +toc: true +toc_label: "" +tags: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +On Monday May 30, 2022, Microsoft issued CVE-2022-30190 regarding the Microsoft Support Diagnostic Tool (MSDT) in Windows vulnerability. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-05-31 +- **Author**: Michael Haag, Teoderick Contreras, Splunk +- **ID**: 2a60a99e-c93a-4036-af70-768fac838019 + +#### Narrative + +A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user''s rights. + +#### Detections + +| Name | Technique | Type | +| ----------- | ----------- |--------------| +| [Windows Command and Scripting Interpreter Path Traversal Exec](/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| TTP | +| [Windows Execute Arbitrary Commands with MSDT](/endpoint/windows_execute_arbitrary_commands_with_msdt/) | [Indirect Command Execution](/tags/#indirect-command-execution)| TTP | +| [Windows Office Product Spawning MSDT](/endpoint/windows_office_product_spawning_msdt/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP | + +#### Reference + +* [https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/](https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/) +* [https://isc.sans.edu/diary/rss/28694](https://isc.sans.edu/diary/rss/28694) +* [https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e](https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e) +* [https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A](https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A) +* [https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/](https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/) +* [https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection](https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection) +* [https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html](https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/stories/microsoft_support_diagnostic_tool_vulnerability_cve-2022-30190.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_stories/spearphishing_attachments.md b/docs/_stories/spearphishing_attachments.md index 7b643da1de..0e17c33da9 100644 --- a/docs/_stories/spearphishing_attachments.md +++ b/docs/_stories/spearphishing_attachments.md @@ -57,6 +57,7 @@ This Analytic Story focuses on detecting signs that a malicious payload has been | [Office Spawning Control](/endpoint/office_spawning_control/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP | | [Process Creating LNK file in Suspicious Location](/endpoint/process_creating_lnk_file_in_suspicious_location/) | [Phishing](/tags/#phishing), [Spearphishing Link](/tags/#spearphishing-link)| TTP | | [Windows ISO LNK File Creation](/endpoint/windows_iso_lnk_file_creation/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing), [Malicious Link](/tags/#malicious-link), [User Execution](/tags/#user-execution)| Hunting | +| [Windows Office Product Spawning MSDT](/endpoint/windows_office_product_spawning_msdt/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP | | [Winword Spawning Cmd](/endpoint/winword_spawning_cmd/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP | | [Winword Spawning PowerShell](/endpoint/winword_spawning_powershell/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP | | [Gdrive suspicious file sharing](/cloud/gdrive_suspicious_file_sharing/) | [Phishing](/tags/#phishing)| Hunting | diff --git a/docs/_stories/windows_defense_evasion_tactics.md b/docs/_stories/windows_defense_evasion_tactics.md index 74d1b0f7be..851282b401 100644 --- a/docs/_stories/windows_defense_evasion_tactics.md +++ b/docs/_stories/windows_defense_evasion_tactics.md @@ -65,6 +65,7 @@ Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adve | [SLUI Spawning a Process](/endpoint/slui_spawning_a_process/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP | | [Suspicious Reg exe Process](/endpoint/suspicious_reg_exe_process/) | [Modify Registry](/tags/#modify-registry)| TTP | | [UAC Bypass MMC Load Unsigned Dll](/endpoint/uac_bypass_mmc_load_unsigned_dll/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP | +| [Windows Command and Scripting Interpreter Path Traversal Exec](/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| TTP | | [Windows Defender Exclusion Registry Entry](/endpoint/windows_defender_exclusion_registry_entry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP | | [Windows Disable Change Password Through Registry](/endpoint/windows_disable_change_password_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly | | [Windows Disable Lock Workstation Feature Through Registry](/endpoint/windows_disable_lock_workstation_feature_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly | diff --git a/docs/mitre-map/coverage.json b/docs/mitre-map/coverage.json index 39f30b0ea8..8035509aff 100644 --- a/docs/mitre-map/coverage.json +++ b/docs/mitre-map/coverage.json @@ -146,13 +146,13 @@ }, { "techniqueID": "T1566.001", - "score": 24, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_iso_lnk_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/suspicious_email_attachment_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml" + "score": 25, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_iso_lnk_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_office_product_spawning_msdt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/suspicious_email_attachment_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml" }, { "techniqueID": "T1566", - "score": 28, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_iso_lnk_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/suspicious_email_attachment_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gdrive_suspicious_file_sharing.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_calendar_invite.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml" + "score": 29, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_iso_lnk_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_office_product_spawning_msdt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/suspicious_email_attachment_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gdrive_suspicious_file_sharing.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_calendar_invite.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml" }, { "techniqueID": "T1048.003", @@ -341,8 +341,8 @@ }, { "techniqueID": "T1059", - "score": 38, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_carry_out_string_command_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/macos_lolbin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_writing_dynamicwrapperx.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_with_discord_dns_query.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/vbscript_execution_using_wscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_module_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml" + "score": 39, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_carry_out_string_command_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/macos_lolbin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_writing_dynamicwrapperx.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_with_discord_dns_query.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/vbscript_execution_using_wscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_module_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml" }, { "techniqueID": "T1105", @@ -981,8 +981,8 @@ }, { "techniqueID": "T1202", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml" }, { "techniqueID": "T1204.001", From e6a9d082b095210a73398390f42d0d97ff6c3ce5 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 1 Jun 2022 09:48:17 +0200 Subject: [PATCH 057/148] follina_path_traversal_update --- ...mand_and_scripting_interpreter_path_traversal_exec.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml index 0644a91e53..a14cdaa66a 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml @@ -1,7 +1,7 @@ name: Windows Command and Scripting Interpreter Path Traversal Exec id: 58fcdeb1-728d-415d-b0d7-3ab18a275ec2 -version: 1 -date: '2022-05-30' +version: 2 +date: '2022-06-01' author: Teoderick Contreras, Splunk type: TTP datamodel: @@ -10,12 +10,12 @@ description: The following analytic identifies path traversal commandline execut using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and commandline that runs before and after this execution. This may help you to find possible downloaded malware or other lolbin execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*\/..\/..\/..\/..\/..\/..\/..\/..\/..\/*" by + as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*\/..\/..\/..\/*" OR Processes.process="*\\..\\..\\..\\*" OR Processes.process="*\/\/..\/\/..\/\/..\/\/*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | `security_content_ctime(lastTime)` | `windows_command_and_scripting_interpreter_path_traversal_exec_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from From 223f4b73ba609fb1396e300beab0b4f6ea83a9a2 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 1 Jun 2022 16:14:46 +0200 Subject: [PATCH 058/148] follina_path_traversal_update --- ...ing_interpreter_hunting_path_traversal.yml | 79 +++++++++++++++++++ ...nterpreter_hunting_path_traversal.test.yml | 13 +++ 2 files changed, 92 insertions(+) create mode 100644 detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml create mode 100644 tests/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.test.yml diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml new file mode 100644 index 0000000000..cfa8473e62 --- /dev/null +++ b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml @@ -0,0 +1,79 @@ +name: Windows Command and Scripting Interpreter Hunting Path Traversal +id: d0026380-b3c4-4da0-ac8e-02790063ff6b +version: 1 +date: '2022-06-01' +author: Teoderick Contreras, Michael Haag, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following analytic identifies path traversal commandline execution. This technique was seen in malicious document that execute malicious code + using msdt.exe and path traversal technique that serve as defense evasion. This Hunting query is a good pivot to look for possible suspicious process and commandline + that runs execute path ttraversal technique to run malicious code. This may help you to find possible downloaded malware or other lolbin execution. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Processes by + Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash + Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process + | `drop_dm_object_name("Processes")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | eval num_pat1 = (mvcount(split(process,"/.."))-1) + | eval num_pat2 = (mvcount(split(process,"\.."))-1) + | eval num_pat3 = (mvcount(split(process,"\\.."))-1) + | eval num_pat4 = (mvcount(split(process,"//.."))-1) + | search num_pat1 > 1 OR num_pat2 > 1 OR num_pat3 > 1 OR num_pat4 > 1 + | `windows_command_and_scripting_interpreter_hunting_path_traversal_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product +known_false_positives: false positive may vary depends on the score you want to check. The bigger number of path traversal string count the better. +references: +- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ +tags: + analytic_story: + - Windows Defense Evasion Tactics + - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 60 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/path_traversal/sysmon.log + impact: 60 + kill_chain_phases: + - Exploitation + message: A parent process $parent_process_name$ has spawned a child $process_name$ with path traversal commandline $process$ in $dest$ + mitre_attack_id: + - T1059 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 36 + security_domain: endpoint diff --git a/tests/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.test.yml b/tests/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.test.yml new file mode 100644 index 0000000000..30208eb4bc --- /dev/null +++ b/tests/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.test.yml @@ -0,0 +1,13 @@ +name: Windows Command and Scripting Interpreter Hunting Path Traversal Unit Test +tests: +- name: Windows Command and Scripting Interpreter Hunting Path Traversal + file: endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/path_traversal/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From da7c18f2343462cd4bf0fdeb527440014d61661b Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 1 Jun 2022 16:28:03 +0200 Subject: [PATCH 059/148] Update windows_command_and_scripting_interpreter_hunting_path_traversal.yml --- ...nd_scripting_interpreter_hunting_path_traversal.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml index cfa8473e62..9a0fb6f789 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml @@ -16,11 +16,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | eval num_pat1 = (mvcount(split(process,"/.."))-1) - | eval num_pat2 = (mvcount(split(process,"\.."))-1) - | eval num_pat3 = (mvcount(split(process,"\\.."))-1) - | eval num_pat4 = (mvcount(split(process,"//.."))-1) - | search num_pat1 > 1 OR num_pat2 > 1 OR num_pat3 > 1 OR num_pat4 > 1 + | eval count_of_pattern1 = (mvcount(split(process,"/.."))-1) + | eval count_of_pattern2 = (mvcount(split(process,"\.."))-1) + | eval count_of_pattern3 = (mvcount(split(process,"\\.."))-1) + | eval count_of_pattern4 = (mvcount(split(process,"//.."))-1) + | search count_of_pattern1 > 1 OR count_of_pattern2 > 1 OR count_of_pattern3 > 1 OR count_of_pattern4 > 1 | `windows_command_and_scripting_interpreter_hunting_path_traversal_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from From f05d4e2df9fd14f2b5b76a05b9c9fd7ac4d0e3f7 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 1 Jun 2022 08:36:13 -0600 Subject: [PATCH 060/148] Update windows_execute_arbitrary_commands_with_msdt.yml --- .../windows_execute_arbitrary_commands_with_msdt.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml index 7b1e061c6b..c78f132699 100644 --- a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml +++ b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml @@ -1,6 +1,6 @@ name: Windows Execute Arbitrary Commands with MSDT id: e1d5145f-38fe-42b9-a5d5-457796715f97 -version: 1 +version: 2 date: '2022-05-30' author: Michael Haag, Teoderick Contreras, Splunk type: TTP @@ -10,11 +10,11 @@ description: The following analytic identifies a recently disclosed arbitraty co During triage, review file modifications for html. Identify parallel process execution that may be related, including an Office Product. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msdt.exe - Processes.process="*ms-msdt:/id*" Processes.process="*IT_BrowseForFile=*" Processes.process="*IT_RebrowseForFile=*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process IN ("*ms-msdt:/id*","*ms-msdt:-id*","*/id*") AND (Processes.process="*IT_BrowseForFile=*" OR Processes.process="*IT_RebrowseForFile=*") AND Processes.process="*PCWDiagnostic*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_execute_arbitrary_commands_with_msdt_filter`' + | `security_content_ctime(lastTime)`| `windows_execute_arbitrary_commands_with_msdt_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: False positives may be present, filter as needed. references: @@ -46,7 +46,7 @@ tags: message: A parent process $parent_process_name$ has spawned a child process $process_name$ on host $dest$ possibly indicative of indirect command execution. mitre_attack_id: - - T1202 + - T1218 nist: - DE.CM observable: From 9941b8009d40f71a653ecd739dcc5a789f7c6043 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 1 Jun 2022 13:13:24 -0400 Subject: [PATCH 061/148] fixing issue with printservice macro --- macros/printservice.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/macros/printservice.yml b/macros/printservice.yml index b9da8fea7c..02f97ed5b5 100644 --- a/macros/printservice.yml +++ b/macros/printservice.yml @@ -1,4 +1,4 @@ -definition: source="wineventlog:microsoft-windows-printservice/operational" OR sourcetype="WinEventLog:Microsoft-Windows-PrintService/Admin" +definition: source="wineventlog:microsoft-windows-printservice/operational" OR source="WinEventLog:Microsoft-Windows-PrintService/Admin" description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. name: printservice From e3b816088b26ddb69d67a3ab70fdae1334eb4e53 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 1 Jun 2022 13:30:32 -0400 Subject: [PATCH 062/148] fixing issues with detection --- ...mgr_process_connecting_to_ip_check_web_services.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml index 7df34f9c2c..e6b0890526 100644 --- a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml +++ b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml @@ -1,8 +1,8 @@ name: Wermgr Process Connecting To IP Check Web Services id: ed313326-a0f9-11eb-a89c-acde48001122 -version: 1 -date: '2021-04-19' -author: Teoderick Contreras, Splunk +version: 2 +date: '2022-06-01' +author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint @@ -17,8 +17,8 @@ search: '`sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfism "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net") - | stats min(_time) as firstTime max(_time) as lastTime count by process_path - process_name process_id QueryName QueryStatus QueryResults Computer EventCode | + | stats min(_time) as firstTime max(_time) as lastTime count by Image + process_name ProcessId QueryName QueryStatus QueryResults Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_connecting_to_ip_check_web_services_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from From 95fd4d85d0256cacd19b51f25c2e1edabd675de0 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 1 Jun 2022 11:31:30 -0600 Subject: [PATCH 063/148] Update windows_execute_arbitrary_commands_with_msdt.yml --- .../endpoint/windows_execute_arbitrary_commands_with_msdt.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml index c78f132699..6150b3a8bd 100644 --- a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml +++ b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml @@ -10,13 +10,13 @@ description: The following analytic identifies a recently disclosed arbitraty co During triage, review file modifications for html. Identify parallel process execution that may be related, including an Office Product. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msdt.exe - Processes.process IN ("*ms-msdt:/id*","*ms-msdt:-id*","*/id*") AND (Processes.process="*IT_BrowseForFile=*" OR Processes.process="*IT_RebrowseForFile=*") AND Processes.process="*PCWDiagnostic*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process IN ("*ms-msdt:/id*","*ms-msdt:-id*","*/id*") AND (Processes.process="*IT_BrowseForFile=*" OR Processes.process="*IT_RebrowseForFile=*" OR Processes.process="*.xml*") AND Processes.process="*PCWDiagnostic*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_execute_arbitrary_commands_with_msdt_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives may be present, filter as needed. +known_false_positives: False positives may be present, filter as needed. Added .xml to potentially capture any answer file usage. Remove as needed. references: - https://isc.sans.edu/diary/rss/28694 - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e From f4cd60d8b509534eeccaf3d8d3358d660cd00321 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 1 Jun 2022 13:40:06 -0400 Subject: [PATCH 064/148] fixing wrong field name --- .../endpoint/windows_installutil_credential_theft.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_installutil_credential_theft.yml b/detections/endpoint/windows_installutil_credential_theft.yml index d2bf537944..d0c6050e63 100644 --- a/detections/endpoint/windows_installutil_credential_theft.yml +++ b/detections/endpoint/windows_installutil_credential_theft.yml @@ -1,8 +1,8 @@ name: Windows InstallUtil Credential Theft id: ccfeddec-43ec-11ec-b494-acde48001122 -version: 1 -date: '2021-11-12' -author: Michael Haag, Splunk +version: 2 +date: '2022-06-01' +author: Michael Haag, Mauricio Velazo, Splunk type: TTP datamodel: - Endpoint @@ -23,7 +23,7 @@ description: 'The following analytic identifies the Windows InstallUtil.exe bina processes. Capture any artifacts and review further.' search: '`sysmon` EventCode=7 process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll", "*\\vaultcli.dll") | stats count min(_time) as firstTime max(_time) as lastTime - by Computer, process_name, ImageLoaded, OriginalFileName, process_id | rename Computer + by Computer, process_name, ImageLoaded, OriginalFileName, ProcessId | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_credential_theft_filter`' how_to_implement: To successfully implement this search, you need to be ingesting From c60117fb6be3bf23eed09e78506e129ca73f18f5 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 1 Jun 2022 13:45:16 -0400 Subject: [PATCH 065/148] fixing broken detection to avoid using non-existing fields --- .../suspicious_process_with_discord_dns_query.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/suspicious_process_with_discord_dns_query.yml b/detections/endpoint/suspicious_process_with_discord_dns_query.yml index c6f3f4b6fe..0724a6c5fb 100644 --- a/detections/endpoint/suspicious_process_with_discord_dns_query.yml +++ b/detections/endpoint/suspicious_process_with_discord_dns_query.yml @@ -1,8 +1,8 @@ name: Suspicious Process With Discord DNS Query id: 4d4332ae-792c-11ec-89c1-acde48001122 -version: 1 -date: '2022-01-19' -author: Teoderick Contreras, Splunk +version: 2 +date: '2022-06-01' +author: Teoderick Contreras, Mauricio Velazco, Splunk type: Anomaly datamodel: - Endpoint @@ -12,9 +12,9 @@ description: This analytic identifies a process making a DNS query to Discord, a external files. A process resolving a Discord DNS name could be an indicator of malware trying to download files from Discord for further execution. search: '`sysmon` EventCode=22 QueryName IN ("*discord*") process_path != "*\\AppData\\Local\\Discord\\*" - AND process_path != "*\\Program Files*" AND process_name != "discord.exe" | stats + AND Image != "*\\Program Files*" AND Image != "discord.exe" | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus - process_name QueryResults Computer process_path | `security_content_ctime(firstTime)` + process_name QueryResults Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_with_discord_dns_query_filter`' how_to_implement: his detection relies on sysmon logs with the Event ID 22, DNS Query. known_false_positives: Noise and false positive can be seen if the following instant @@ -68,7 +68,6 @@ tags: - process_name - QueryResults - Computer - - process_path risk_score: 64 security_domain: endpoint asset_type: Endpoint From f79d1ddb2300932fa927c6e4fc07e0c71958081e Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 1 Jun 2022 14:07:23 -0400 Subject: [PATCH 066/148] fixing wrong field name --- .../endpoint/mshtml_module_load_in_office_product.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/mshtml_module_load_in_office_product.yml index 4a7bb55824..b8f229bd70 100644 --- a/detections/endpoint/mshtml_module_load_in_office_product.yml +++ b/detections/endpoint/mshtml_module_load_in_office_product.yml @@ -1,8 +1,8 @@ name: MSHTML Module Load in Office Product id: 5f1c168e-118b-11ec-84ff-acde48001122 -version: 1 -date: '2021-09-09' -author: Michael Haag, Splunk +version: 2 +date: '2022-06-01' +author: Michael Haag, Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint @@ -14,7 +14,7 @@ description: The following detection identifies the module load of mshtml.dll in search: '`sysmon` EventID=7 process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, - ImageLoaded, OriginalFileName, process_id | rename Computer as dest | `security_content_ctime(firstTime)` + ImageLoaded, OriginalFileName, ProcessId | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mshtml_module_load_in_office_product_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process names and image loads from your endpoints. If you are using From 7686814bc7f3bce9a2106f43bd95b6ff06b755e3 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 1 Jun 2022 14:18:11 -0400 Subject: [PATCH 067/148] fixing wrong field name --- detections/endpoint/spoolsv_suspicious_loaded_modules.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml index 846127e4b0..c602c1ba3c 100644 --- a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml +++ b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml @@ -1,6 +1,6 @@ name: Spoolsv Suspicious Loaded Modules id: a5e451f8-da81-11eb-b245-acde48001122 -version: 1 +version: 2 date: '2021-07-01' author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk type: TTP @@ -12,7 +12,7 @@ description: This search is to detect suspicious loading of dll in specific path search: '`sysmon` EventCode=7 Image ="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*" ImageLoaded = "*.dll" | stats dc(ImageLoaded) as countImgloaded values(ImageLoaded) as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer - process_id EventCode | where countImgloaded >= 3 | `security_content_ctime(firstTime)` + ProcessId EventCode | where countImgloaded >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_suspicious_loaded_modules_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you From f4237cac86faaea9f3945cddc06514fafd8367c9 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 1 Jun 2022 12:34:48 -0700 Subject: [PATCH 068/148] updating datasets after sim --- detections/endpoint/unload_sysmon_filter_driver.yml | 13 +++++++------ tests/endpoint/unload_sysmon_filter_driver.test.yml | 2 +- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/unload_sysmon_filter_driver.yml b/detections/endpoint/unload_sysmon_filter_driver.yml index 445214b399..a606ddb0c0 100644 --- a/detections/endpoint/unload_sysmon_filter_driver.yml +++ b/detections/endpoint/unload_sysmon_filter_driver.yml @@ -1,7 +1,7 @@ name: Unload Sysmon Filter Driver id: e5928ff3-23eb-4d8b-b8a4-dcbc844fdfbe -version: 3 -date: '2020-07-22' +version: 4 +date: '2022-06-01' author: Bhavin Patel, Splunk type: TTP datamodel: @@ -22,12 +22,13 @@ how_to_implement: You must be ingesting data that records process activity from The command-line arguments are mapped to the "process" field in the Endpoint data model. This search is also shipped with `unload_sysmon_filter_driver_filter` macro, update this macro to filter out false positives. -known_false_positives: '' -references: [] +known_false_positives: 'Unkown at the moment' +references: + - https://www.ired.team/offensive-security/defense-evasion/unloading-sysmon-driver tags: analytic_story: - Disabling Security Tools - asset_type: '' + asset_type: Endpoint cis20: - CIS 8 confidence: 90 @@ -35,7 +36,7 @@ tags: - Source:Endpoint - Stage:Defense Evasion dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/unload_sysmon/windows-sysmon.log impact: 50 kill_chain_phases: - Actions on Objectives diff --git a/tests/endpoint/unload_sysmon_filter_driver.test.yml b/tests/endpoint/unload_sysmon_filter_driver.test.yml index 7a95da22a0..46276d54f5 100644 --- a/tests/endpoint/unload_sysmon_filter_driver.test.yml +++ b/tests/endpoint/unload_sysmon_filter_driver.test.yml @@ -7,6 +7,6 @@ tests: latest_time: now attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/unload_sysmon/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog From 779ecc584750447476cea492b5dccdaa1b8bdf8a Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 1 Jun 2022 12:37:43 -0700 Subject: [PATCH 069/148] typo --- detections/endpoint/unload_sysmon_filter_driver.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/unload_sysmon_filter_driver.yml b/detections/endpoint/unload_sysmon_filter_driver.yml index a606ddb0c0..54d0e13711 100644 --- a/detections/endpoint/unload_sysmon_filter_driver.yml +++ b/detections/endpoint/unload_sysmon_filter_driver.yml @@ -22,7 +22,7 @@ how_to_implement: You must be ingesting data that records process activity from The command-line arguments are mapped to the "process" field in the Endpoint data model. This search is also shipped with `unload_sysmon_filter_driver_filter` macro, update this macro to filter out false positives. -known_false_positives: 'Unkown at the moment' +known_false_positives: 'Unknown at the moment' references: - https://www.ired.team/offensive-security/defense-evasion/unloading-sysmon-driver tags: From 97d51b71bf056a4ee1777f69bf1b8cf40769b0e0 Mon Sep 17 00:00:00 2001 From: d1vious Date: Wed, 1 Jun 2022 17:03:00 -0400 Subject: [PATCH 070/148] adding cves --- ...splunk_command_and_scripting_interpreter_delete_usage.yml | 4 +++- ...lunk_command_and_scripting_interpreter_risky_commands.yml | 4 +++- .../splunk_digital_certificates_infrastructure_version.yml | 4 +++- .../splunk_digital_certificates_lack_of_encryption.yml | 2 ++ .../splunk_process_injection_forwarder_bundle_downloads.yml | 5 ++++- ..._protocol_impersonation_weak_encryption_configuration.yml | 4 +++- ...unk_protocol_impersonation_weak_encryption_selfsigned.yml | 4 +++- ..._protocol_impersonation_weak_encryption_simplerequest.yml | 4 +++- .../network/splunk_identified_ssl_tls_certificates.yml | 5 ++++- 9 files changed, 28 insertions(+), 8 deletions(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml index c04a9f5562..6fdeed8d30 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml @@ -25,6 +25,8 @@ tags: - CIS 3 - CIS 5 - CIS 16 + cve: + - CVE-2022-32154 confidence: 100 context: - Source:Endpoint @@ -57,4 +59,4 @@ tags: - Search_Activity.search_type risk_score: 100 security_domain: audit - \ No newline at end of file + diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml index f940895bc3..34d2176d03 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml @@ -29,6 +29,8 @@ tags: - CIS 3 - CIS 5 - CIS 16 + cve: + CVE-2022-32154 confidence: 40 context: - Source:Endpoint @@ -61,4 +63,4 @@ tags: - Search_Activity.search_type risk_score: 20 security_domain: audit - \ No newline at end of file + diff --git a/detections/application/splunk_digital_certificates_infrastructure_version.yml b/detections/application/splunk_digital_certificates_infrastructure_version.yml index a053b6a5fe..620e753281 100644 --- a/detections/application/splunk_digital_certificates_infrastructure_version.yml +++ b/detections/application/splunk_digital_certificates_infrastructure_version.yml @@ -5,7 +5,7 @@ date: '2022-05-26' author: Lou Stella, Splunk type: Hunting datamodel: [] -description: On June 10th, 2022, Splunk released a security advisory relating to TLS validation occuring between different parts of Splunk Enterprise Infrastructure. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. +description: On June 14th, 2022, Splunk released a security advisory relating to TLS validation occuring between different parts of Splunk Enterprise Infrastructure. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="sslConfig"| table splunk_server sslVerifyServerCert sslVerifyServerName serverCert] | fillnull value="Not Set" | rename sslVerifyServerCert as "Server.conf:SslConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:SslConfig:sslVerifyServerName", serverCert as "Server.conf:SslConfig:serverCert" | `splunk_digital_certificates_infrastructure_version_filter`' how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers. known_false_positives: No known at this time. @@ -20,6 +20,8 @@ tags: - CIS 3 - CIS 5 - CIS 16 + cve: + - CVE-2022-32153 confidence: 100 context: - Source:Endpoint diff --git a/detections/application/splunk_digital_certificates_lack_of_encryption.yml b/detections/application/splunk_digital_certificates_lack_of_encryption.yml index 56daf54a7a..8b2f4ab058 100644 --- a/detections/application/splunk_digital_certificates_lack_of_encryption.yml +++ b/detections/application/splunk_digital_certificates_lack_of_encryption.yml @@ -20,6 +20,8 @@ tags: - CIS 3 - CIS 5 - CIS 16 + cve: + - CVE-2022-32151 confidence: 80 context: - Source:Endpoint diff --git a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml index c777653269..e2de4532d5 100644 --- a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml +++ b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml @@ -5,7 +5,7 @@ date: '2022-05-26' author: Lou Stella, Splunk type: Hunting datamodel: [] -description: On June 10th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. This hunting search pulls a full list of forwarder bundle downloads where peer is the forwarder, host is the Deployment Server, and then you have a list of the apps downloaded and the serverclasses in which the peer is a member of. You should look for apps or clients that you do not recognize as being part of your environment. +description: On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. This hunting search pulls a full list of forwarder bundle downloads where peer is the forwarder, host is the Deployment Server, and then you have a list of the apps downloaded and the serverclasses in which the peer is a member of. You should look for apps or clients that you do not recognize as being part of your environment. search: '`splunkd` component="PackageDownloadRestHandler" | stats values(app) values(serverclass) by peer, host | `splunk_process_injection_forwarder_bundle_downloads_filter`' how_to_implement: This hunting search uses native logs produced when a deployment server is within your environment. known_false_positives: None at this time. @@ -20,6 +20,9 @@ tags: - CIS 3 - CIS 5 - CIS 16 + cve: + - CVE-2022-32157 + - CVE-2022-32158 confidence: 70 context: - Source:Endpoint diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index ad0c8be65c..1eeca76ac5 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -5,7 +5,7 @@ date: '2022-05-25' author: Lou Stella, Splunk type: Hunting datamodel: [] -description: On June 10th, 2022, Splunk released a security advisory relating to TLS validation occuring within the httplib and urllib python libraries shipped with Splunk. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. In addition to these settings, the PYTHONHTTPSVERIFY setting in $SPLUNK_HOME/etc/splunk-launch.conf needs to be enabled as well. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. +description: On June 14th, 2022, Splunk released a security advisory relating to TLS validation occuring within the httplib and urllib python libraries shipped with Splunk. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. In addition to these settings, the PYTHONHTTPSVERIFY setting in $SPLUNK_HOME/etc/splunk-launch.conf needs to be enabled as well. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="PythonSslClientConfig" | table splunk_server sslVerifyServerCert sslVerifyServerName] | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-web/settings | table splunk_server serverCert sslVersions] | rename sslVerifyServerCert as "Server.conf:PythonSSLClientConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:PythonSSLClientConfig:sslVerifyServerName", serverCert as "Web.conf:Settings:serverCert", sslVersions as "Web.conf:Settings:sslVersions" | `splunk_protocol_impersonation_weak_encryption_configuration_filter`' how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers. known_false_positives: While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration. @@ -20,6 +20,8 @@ tags: - CIS 3 - CIS 5 - CIS 16 + cve: + - CVE-2022-32151 confidence: 100 context: - Source:Endpoint diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml index 4987ba912a..66f769a0e1 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -6,7 +6,7 @@ author: Rod Soto, Splunk type: Hunting datamodel: [] search: '| `splk_cert_validation_tls_selfsigned` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | splunk_protocol_impersonation_weak_encryption_selfsigned_filter' -description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates. +description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. known_false_positives: This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward. references: @@ -16,6 +16,8 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Endpoint + cve: + - CVE-2022-32152 confidence: 80 context: - Source:Endpoint diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index 3e950747b4..5c653533c7 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -6,7 +6,7 @@ author: Rod Soto, Splunk type: Hunting datamodel: [] search: '| `splk_cert_validation_tls` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | splunk_protocol_impersonation_weak_encryption_simplerequest_filter' -description: On june 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store.This search warns about failure to validate certification using python3 request. +description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store.This search warns about failure to validate certification using python3 request. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. references: @@ -16,6 +16,8 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Endpoint + cve: + - CVE-2022-32152 confidence: 80 context: - Source:Endpoint diff --git a/detections/network/splunk_identified_ssl_tls_certificates.yml b/detections/network/splunk_identified_ssl_tls_certificates.yml index 71a7988185..d20ed006b3 100644 --- a/detections/network/splunk_identified_ssl_tls_certificates.yml +++ b/detections/network/splunk_identified_ssl_tls_certificates.yml @@ -21,6 +21,9 @@ tags: - CIS 3 - CIS 5 - CIS 16 + cve: + - CVE-2022-32151 + - CVE-2022-32152 confidence: 100 context: - Source:Application Log @@ -51,4 +54,4 @@ tags: - host - sourcetype risk_score: 100 - security_domain: network \ No newline at end of file + security_domain: network From 11ab1d104bbfd332ff810f13ecbf6904a228fe22 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 1 Jun 2022 15:20:15 -0600 Subject: [PATCH 071/148] text --- ..._command_and_scripting_interpreter_path_traversal_exec.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml index a14cdaa66a..f084d38485 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml @@ -6,8 +6,8 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: The following analytic identifies path traversal commandline execution. This technique was seen in malicious document that execute malicious code - using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and commandline +description: The following analytic identifies path traversal command-line execution. This technique was seen in malicious document that execute malicious code + using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and command-line that runs before and after this execution. This may help you to find possible downloaded malware or other lolbin execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*\/..\/..\/..\/*" OR Processes.process="*\\..\\..\\..\\*" OR Processes.process="*\/\/..\/\/..\/\/..\/\/*" by From 58cb36ab2c748ecd32524b3b0256919631879a2f Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 1 Jun 2022 15:21:08 -0600 Subject: [PATCH 072/148] Update windows_command_and_scripting_interpreter_hunting_path_traversal.yml --- ...and_and_scripting_interpreter_hunting_path_traversal.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml index 9a0fb6f789..441b05763f 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml @@ -6,9 +6,9 @@ author: Teoderick Contreras, Michael Haag, Splunk type: Hunting datamodel: - Endpoint -description: The following analytic identifies path traversal commandline execution. This technique was seen in malicious document that execute malicious code - using msdt.exe and path traversal technique that serve as defense evasion. This Hunting query is a good pivot to look for possible suspicious process and commandline - that runs execute path ttraversal technique to run malicious code. This may help you to find possible downloaded malware or other lolbin execution. +description: The following analytic identifies path traversal command-line execution. This technique was seen in malicious document that execute malicious code + using msdt.exe and path traversal technique that serve as defense evasion. This Hunting query is a good pivot to look for possible suspicious process and command-line + that runs execute path traversal technique to run malicious code. This may help you to find possible downloaded malware or other lolbin execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash From f6dda32dd2c2be5d535aab17c8f217813b0d53fc Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 1 Jun 2022 15:38:29 -0600 Subject: [PATCH 073/148] Update windows_command_and_scripting_interpreter_hunting_path_traversal.yml --- ...command_and_scripting_interpreter_hunting_path_traversal.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml index 441b05763f..ff4c9749ac 100644 --- a/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml +++ b/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Michael Haag, Splunk type: Hunting datamodel: - Endpoint -description: The following analytic identifies path traversal command-line execution. This technique was seen in malicious document that execute malicious code +description: The following analytic identifies path traversal command-line execution and should be used to tune and driver other more higher fidelity analytics. This technique was seen in malicious document that execute malicious code using msdt.exe and path traversal technique that serve as defense evasion. This Hunting query is a good pivot to look for possible suspicious process and command-line that runs execute path traversal technique to run malicious code. This may help you to find possible downloaded malware or other lolbin execution. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) From d5a1d0010e04ff5bf1abed97cd58698409a3a0f3 Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Wed, 1 Jun 2022 17:19:38 -0700 Subject: [PATCH 074/148] added cis tags --- ...k_protocol_impersonation_weak_encryption_simplerequest.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index 5c653533c7..a0d7b45a46 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -18,6 +18,10 @@ tags: asset_type: Endpoint cve: - CVE-2022-32152 + cis20: + - CIS 3 + - CIS 5 + - CIS 16 confidence: 80 context: - Source:Endpoint From ae4dc0039298c1fe479101de536e05881c92e9a2 Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Wed, 1 Jun 2022 17:21:54 -0700 Subject: [PATCH 075/148] tags added --- ...unk_protocol_impersonation_weak_encryption_simplerequest.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index a0d7b45a46..cb24899fd6 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -33,6 +33,8 @@ tags: message: Failed to validate certificate on host$ mitre_attack_id: - T1588.004 + nist: + - DE.CM observable: - name: Hostname type: Hostname From 9b6cd6a022b667c1f97f5dbd60c5fdc88820423d Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Wed, 1 Jun 2022 17:31:53 -0700 Subject: [PATCH 076/148] added tags --- ...nk_protocol_impersonation_weak_encryption_selfsigned.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml index 66f769a0e1..ef8644690a 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -16,6 +16,10 @@ tags: analytic_story: - Splunk Vulnerabilities asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 cve: - CVE-2022-32152 confidence: 80 @@ -29,6 +33,8 @@ tags: message: Splunk default issued certificate at host$ mitre_attack_id: - T1588.004 + nist: + - DE.CM observable: - name: Hostname type: Hostname From 61e827c41e8975c18530e26f8ea31ae42fb068cb Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Wed, 1 Jun 2022 17:38:28 -0700 Subject: [PATCH 077/148] added - to CVE --- ...plunk_command_and_scripting_interpreter_risky_commands.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml index 34d2176d03..9d68135295 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml @@ -29,9 +29,9 @@ tags: - CIS 3 - CIS 5 - CIS 16 - cve: - CVE-2022-32154 confidence: 40 + cve: + - CVE-2022-32154 context: - Source:Endpoint dataset: From c247d2cdd4a800fb373ef723683f3fce53d974ed Mon Sep 17 00:00:00 2001 From: Danny Leung Date: Thu, 2 Jun 2022 21:03:36 -0700 Subject: [PATCH 078/148] PEX-76: remove detection_names; modify detections to only contain name attribute --- .../adapter/obj_to_json_adapter.py | 1 - .../builder/security_content_story_builder.py | 6 ++---- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_json_adapter.py b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_json_adapter.py index 183b404d6e..0e6dce1880 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_json_adapter.py +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_json_adapter.py @@ -36,7 +36,6 @@ class ObjToJsonAdapter(Adapter): obj_array.append(story.dict(exclude_none=True, exclude = { - "detections": True, "investigations": True } )) diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py index 1518b69f31..2fd3fcc290 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py @@ -29,7 +29,6 @@ class SecurityContentStoryBuilder(StoryBuilder): return self.story def addDetections(self, detections: list) -> None: - matched_detection_names = [] matched_detections = [] mitre_attack_enrichments = [] mitre_attack_tactics = set() @@ -40,8 +39,8 @@ class SecurityContentStoryBuilder(StoryBuilder): if detection: for detection_analytic_story in detection.tags.analytic_story: if detection_analytic_story == self.story.name: - matched_detection_names.append(str('ESCU - ' + detection.name + ' - Rule')) - matched_detections.append(detection) + # SSE-638: detections should only contain the 'name' attribute + matched_detections.append({"name" : detection.name}) datamodels.update(detection.datamodel) if detection.tags.kill_chain_phases: kill_chain_phases.update(detection.tags.kill_chain_phases) @@ -52,7 +51,6 @@ class SecurityContentStoryBuilder(StoryBuilder): if attack_enrichment.mitre_attack_id not in [attack.mitre_attack_id for attack in mitre_attack_enrichments]: mitre_attack_enrichments.append(attack_enrichment) - self.story.detection_names = matched_detection_names self.story.detections = matched_detections self.story.tags.datamodels = sorted(list(datamodels)) self.story.tags.kill_chain_phases = sorted(list(kill_chain_phases)) From 6dddbfaee815b7a4eeefba88be34252ce2cff667 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 3 Jun 2022 12:55:23 +0200 Subject: [PATCH 079/148] detection-fix-due-to-splunk-time --- .../endpoint/linux_iptables_firewall_modification.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/linux_iptables_firewall_modification.yml b/detections/endpoint/linux_iptables_firewall_modification.yml index cec01c4d5e..d5ee4e0533 100644 --- a/detections/endpoint/linux_iptables_firewall_modification.yml +++ b/detections/endpoint/linux_iptables_firewall_modification.yml @@ -1,7 +1,7 @@ name: Linux Iptables Firewall Modification id: 309d59dc-1e1b-49b2-9800-7cf18d12f7b7 -version: 2 -date: '2022-04-30' +version: 3 +date: '2022-06-03' author: Teoderick Contreras, Splunk type: Anomaly datamodel: @@ -12,10 +12,11 @@ description: This analytic looks for suspicious commandline that modify the ipta search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*iptables *" AND Processes.process = "* --dport *" AND Processes.process = "* ACCEPT*" AND Processes.process = "*&>/dev/null*" AND Processes.process = "* tcp *" AND NOT(Processes.parent_process_path IN("/bin/*", "/lib/*", "/usr/bin/*", "/sbin/*")) - by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest + by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest _time span=10s Processes.user Processes.parent_process_name Processes.parent_process_path Processes.process_path | rex field=Processes.process "--dport (?3269|636|989|994|995|8443)" - | stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) as guids values(Processes.process_id) as pids dc(port) as port_count count by Processes.process_name Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user Processes.parent_process_path Processes.process_path firstTime lastTime | where port_count >=3 + | stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) as guids values(Processes.process_id) as pids dc(port) as port_count count + by Processes.process_name Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user Processes.parent_process_path Processes.process_path | where port_count >=3 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From 136a3a1b923eb643fb5806bf449ffa435297be94 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 3 Jun 2022 16:30:32 +0200 Subject: [PATCH 080/148] detection-fix-due-to-splunk-time --- .../excessive_usage_of_nslookup_app.yml | 21 ++++++++++++------- .../excessive_usage_of_nslookup_app.test.yml | 4 ++-- 2 files changed, 15 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index 2a9fc6e0b7..2788083721 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -1,7 +1,7 @@ name: Excessive Usage of NSLOOKUP App id: 0a69fdaa-a2b8-11eb-b16d-acde48001122 -version: 1 -date: '2021-04-21' +version: 2 +date: '2022-06-03' author: Teoderick Contreras, Stanislav Miskovic, Splunk type: Anomaly datamodel: @@ -12,12 +12,16 @@ description: This search is to detect potential DNS exfiltration using nslookup use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. -search: '`sysmon` EventCode = 1 process_name = "nslookup.exe" | bucket _time span=15m - | stats count as numNsLookup by Computer, _time | eventstats avg(numNsLookup) as - avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer | eval - upperThreshold=(avgNsLookup + stdNsLookup *3) | eval isOutlier=if(avgNsLookup > - 20 and avgNsLookup >= upperThreshold, 1, 0) | search isOutlier=1 | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `excessive_usage_of_nslookup_app_filter`' +search: '`sysmon` EventCode = 1 process_name = "nslookup.exe" + | bucket _time span=15m + | stats count as numNsLookup by Computer, _time + | eventstats avg(numNsLookup) as avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer + | eval upperThreshold=(avgNsLookup + stdNsLookup *3) + | eval isOutlier=if(numNsLookup > 20 and numNsLookup >= upperThreshold, 1, 0) + | search isOutlier=1 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `excessive_usage_of_nslookup_app_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -39,6 +43,7 @@ tags: - Scope:Local - Stage:Exfiltration dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/sysmon.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log impact: 40 kill_chain_phases: diff --git a/tests/endpoint/excessive_usage_of_nslookup_app.test.yml b/tests/endpoint/excessive_usage_of_nslookup_app.test.yml index 2822fb969c..d580a2f675 100644 --- a/tests/endpoint/excessive_usage_of_nslookup_app.test.yml +++ b/tests/endpoint/excessive_usage_of_nslookup_app.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog From ad992a4d88fd8ee2d61018a1a53b3d3962ae2d08 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 3 Jun 2022 16:33:18 +0200 Subject: [PATCH 081/148] Update excessive_usage_of_nslookup_app.yml --- detections/endpoint/excessive_usage_of_nslookup_app.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index 2788083721..892c8587e5 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -13,7 +13,7 @@ description: This search is to detect potential DNS exfiltration using nslookup commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. search: '`sysmon` EventCode = 1 process_name = "nslookup.exe" - | bucket _time span=15m + | bucket _time span=1m | stats count as numNsLookup by Computer, _time | eventstats avg(numNsLookup) as avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer | eval upperThreshold=(avgNsLookup + stdNsLookup *3) From 5b46edc201e6e4cc1482d7ae174442f9a9ad57b3 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 3 Jun 2022 21:29:00 -0600 Subject: [PATCH 082/148] Fluent in Confluence --- ...d_remote_code_execution_cve_2022_26314.yml | 72 +++++++++++++++++++ ..._server_and_data_center_cve_2022_26134.yml | 22 ++++++ ...ote_code_execution_cve_2022_26314.test.yml | 13 ++++ 3 files changed, 107 insertions(+) create mode 100644 detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml create mode 100644 stories/atlassian_confluence_server_and_data_center_cve_2022_26134.yml create mode 100644 tests/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.test.yml diff --git a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml new file mode 100644 index 0000000000..000e524b61 --- /dev/null +++ b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml @@ -0,0 +1,72 @@ +name: Confluence Unauthenticated Remote Code Execution CVE-2022-26314 +id: fcf4bd3f-a79f-4b7a-83bf-2692d60b859c +version: 1 +date: '2022-06-03' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic assists with identifying CVE-2022-26314 based exploitation utilizing the Web datamodel to cover network and CIM compliant web logs. The parameters were captured from live scanning and the POC provided by Rapid7. + During triage, review any endpoint based logs for further activity including writing a jsp file to disk and commands/processes spawning running as root from the Confluence process. +search: '| tstats count min(_time) as firstTime max(_time) + as lastTime from datamodel=Web where Web.url IN ("*${*", "*%2F%7B*") Web.url="*org.apache.commons.io.IOUtils*" Web.url="*java.lang.Runtime@getRuntime().exec*" + by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest sourcetype + | `drop_dm_object_name("Web")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `confluence_unauthenticated_remote_code_execution_cve_2022_26314_filter`' +how_to_implement: This detection requires the Web datamodel to be populated from a + supported Technology Add-On like Splunk for Apache or Splunk for Nginx. In addition, network based logs or event data like PAN Threat. +known_false_positives: Tune based on assets if possible, or restrict to known Confluence servers. Remove the ${ for a more broad query. To identify more exec, remove everything up to the last parameter (Runtime().exec) for a broad query. +references: + - https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html + - https://www.splunk.com/en_us/blog/security/atlassian-confluence-vulnerability-cve-2022-26134.html + - https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/ + - https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/ +tags: + analytic_story: + - Atlassian Confluence Server and Data Center CVE-2022-26134 + asset_type: Web Server + cve: + - CVE-2022-26134 + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 100 + context: + - Update context + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/java/confluence.log + impact: 100 + kill_chain_phases: + - Exploitation + message: A URL was requested related to CVE-2022-26314, a unauthenticated remote code execution vulnerability, on $dest$ by $src$. + mitre_attack_id: + - T1505 + - T1190 + nist: + - DE.CM + observable: + - name: dest + type: IP Address + role: + - Victim + - name: src + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Web.http_method + - Web.url + - Web.url_length + - Web.src + - Web.dest + - Web.http_user_agent + risk_score: 100 + security_domain: network diff --git a/stories/atlassian_confluence_server_and_data_center_cve_2022_26134.yml b/stories/atlassian_confluence_server_and_data_center_cve_2022_26134.yml new file mode 100644 index 0000000000..b2a7036b12 --- /dev/null +++ b/stories/atlassian_confluence_server_and_data_center_cve_2022_26134.yml @@ -0,0 +1,22 @@ +name: Atlassian Confluence Server and Data Center CVE-2022-26134 +id: 91623a50-41fa-4c4e-8637-c239b80ff439 +version: 1 +date: '2022-06-03' +author: Michael Haag, Splunk +description: On June 2, security researchers at Volexity published a blog outlining the discovery of an unauthenticated remote code execution zero day vulnerability (CVE-2022-26134) being actively exploited in Atlassian Confluence Server and Data Center instances in the wild. Atlassian released a fix within 24 hours of the blog''s release. +narrative: Atlassian describes the vulnerability as an Object-Graph Navigation Language (OGNL) injection allowing an unauthenticated user to execute arbitrary code on a Confluence Server or Data Server instance. Volexity did not release proof-of-concept (POC) exploit code, but researchers there have observed coordinated, widespread exploitation. + Volexity first discovered the vulnerability over the weekend on two Internet-facing web servers running Confluence Server software. The investigation was due to suspicious activity on the hosts, including JSP webshells that were written to disk. +references: + - https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html + - https://www.splunk.com/en_us/blog/security/atlassian-confluence-vulnerability-cve-2022-26134.html + - https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/ + - https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/ +tags: + analytic_story: Atlassian Confluence Server and Data Center CVE-2022-26134 + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Application Security diff --git a/tests/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.test.yml b/tests/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.test.yml new file mode 100644 index 0000000000..5ec0a58ff2 --- /dev/null +++ b/tests/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.test.yml @@ -0,0 +1,13 @@ +name: Confluence Unauthenticated Remote Code Execution CVE-2022-26314 Unit Test +tests: +- name: Confluence Unauthenticated Remote Code Execution CVE-2022-26314 + file: web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: confluence.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/java/confluence.log + source: pan:threat + sourcetype: pan:threat + update_timestamp: true From a28de38199433639913f7f899472ad4e637badbb Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 3 Jun 2022 21:34:38 -0600 Subject: [PATCH 083/148] tags --- detections/endpoint/java_writing_jsp_file.yml | 1 + ...nce_unauthenticated_remote_code_execution_cve_2022_26314.yml | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/java_writing_jsp_file.yml b/detections/endpoint/java_writing_jsp_file.yml index ad7adf98b7..d95f7c766d 100644 --- a/detections/endpoint/java_writing_jsp_file.yml +++ b/detections/endpoint/java_writing_jsp_file.yml @@ -26,6 +26,7 @@ references: tags: analytic_story: - Spring4Shell CVE-2022-22965 + - Atlassian Confluence Server and Data Center CVE-2022-26134 cve: - CVE-2022-22965 asset_type: Endpoint diff --git a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml index 000e524b61..30e4c42f3c 100644 --- a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml +++ b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml @@ -35,7 +35,7 @@ tags: - CIS 16 confidence: 100 context: - - Update context + - Scope:Network dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/java/confluence.log impact: 100 From 05cd8a648db02a23dbf08ecb3ddf0041118ad318 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 3 Jun 2022 21:35:48 -0600 Subject: [PATCH 084/148] Update java_writing_jsp_file.yml --- detections/endpoint/java_writing_jsp_file.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/java_writing_jsp_file.yml b/detections/endpoint/java_writing_jsp_file.yml index d95f7c766d..d190e1b7af 100644 --- a/detections/endpoint/java_writing_jsp_file.yml +++ b/detections/endpoint/java_writing_jsp_file.yml @@ -1,12 +1,13 @@ name: Java Writing JSP File id: eb65619c-4f8d-4383-a975-d352765d344b -version: 1 -date: '2022-04-05' +version: 2 +date: '2022-06-03' author: Michael Haag, Splunk type: TTP datamodel: - Endpoint description: The following analytic identifies the process java writing a .jsp to disk. This is potentially indicative of a web shell being written to disk. + Modify and tune the analytic based on data ingested. For instance, it may be worth running a broad query for jsp file writes first before performing a join. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN ("java","java.exe", "javaw.exe") by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid Processes.user | `drop_dm_object_name(Processes)` | join process_guid [| tstats From 3891cbcd0f222fdebb2aac548e99b0901312c004 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Sat, 4 Jun 2022 16:56:27 -0600 Subject: [PATCH 085/148] Update confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml --- ...nce_unauthenticated_remote_code_execution_cve_2022_26314.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml index 30e4c42f3c..217c89eadb 100644 --- a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml +++ b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml @@ -9,7 +9,7 @@ datamodel: description: The following analytic assists with identifying CVE-2022-26314 based exploitation utilizing the Web datamodel to cover network and CIM compliant web logs. The parameters were captured from live scanning and the POC provided by Rapid7. During triage, review any endpoint based logs for further activity including writing a jsp file to disk and commands/processes spawning running as root from the Confluence process. search: '| tstats count min(_time) as firstTime max(_time) - as lastTime from datamodel=Web where Web.url IN ("*${*", "*%2F%7B*") Web.url="*org.apache.commons.io.IOUtils*" Web.url="*java.lang.Runtime@getRuntime().exec*" + as lastTime from datamodel=Web where Web.url IN ("*${*", "*%2F%7B*") (Web.url="*org.apache.commons.io.IOUtils*" Web.url="*java.lang.Runtime@getRuntime().exec*") OR (Web.url="*java.lang.Runtime%40getRuntime%28%29.exec*" Web.url="*org.apache.commons.io.IOUtils%40*") by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest sourcetype | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` From 6d56a434359c6fb18586bb0cd74908d8be9bc855 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 6 Jun 2022 07:46:17 -0600 Subject: [PATCH 086/148] Update confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml --- ...unauthenticated_remote_code_execution_cve_2022_26314.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml index 217c89eadb..7acaf4514f 100644 --- a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml +++ b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml @@ -6,10 +6,10 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: The following analytic assists with identifying CVE-2022-26314 based exploitation utilizing the Web datamodel to cover network and CIM compliant web logs. The parameters were captured from live scanning and the POC provided by Rapid7. - During triage, review any endpoint based logs for further activity including writing a jsp file to disk and commands/processes spawning running as root from the Confluence process. +description: The following analytic assists with identifying CVE-2022-26314 based exploitation utilizing the Web datamodel to cover network and CIM compliant web logs. The parameters were captured from live scanning and the POC provided by Rapid7. This analytic is written against multiple proof of concept codes released and see in the wild (scanning). + During triage, review any endpoint based logs for further activity including writing a jsp file to disk and commands/processes spawning running as root from the Confluence process. search: '| tstats count min(_time) as firstTime max(_time) - as lastTime from datamodel=Web where Web.url IN ("*${*", "*%2F%7B*") (Web.url="*org.apache.commons.io.IOUtils*" Web.url="*java.lang.Runtime@getRuntime().exec*") OR (Web.url="*java.lang.Runtime%40getRuntime%28%29.exec*" Web.url="*org.apache.commons.io.IOUtils%40*") + as lastTime from datamodel=Web where Web.url IN ("*${*", "*%2F%7B*") (Web.url="*org.apache.commons.io.IOUtils*" Web.url="*java.lang.Runtime@getRuntime().exec*") OR (Web.url="*java.lang.Runtime%40getRuntime%28%29.exec*") OR (Web.url="*getEngineByName*" AND Web.url="*nashorn*" AND Web.url="*ProcessBuilder*") by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest sourcetype | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` From 518251e8c83215d690f2fd7a66a37647c183169a Mon Sep 17 00:00:00 2001 From: Danny Leung Date: Mon, 6 Jun 2022 09:51:16 -0700 Subject: [PATCH 087/148] PEX-76: add back the detection_names obj --- .../builder/security_content_story_builder.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py index 2fd3fcc290..d1c3d041dd 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py @@ -29,6 +29,7 @@ class SecurityContentStoryBuilder(StoryBuilder): return self.story def addDetections(self, detections: list) -> None: + matched_detection_names = [] matched_detections = [] mitre_attack_enrichments = [] mitre_attack_tactics = set() @@ -39,6 +40,7 @@ class SecurityContentStoryBuilder(StoryBuilder): if detection: for detection_analytic_story in detection.tags.analytic_story: if detection_analytic_story == self.story.name: + matched_detection_names.append(str('ESCU - ' + detection.name + ' - Rule')) # SSE-638: detections should only contain the 'name' attribute matched_detections.append({"name" : detection.name}) datamodels.update(detection.datamodel) @@ -51,6 +53,7 @@ class SecurityContentStoryBuilder(StoryBuilder): if attack_enrichment.mitre_attack_id not in [attack.mitre_attack_id for attack in mitre_attack_enrichments]: mitre_attack_enrichments.append(attack_enrichment) + self.story.detection_names = matched_detection_names self.story.detections = matched_detections self.story.tags.datamodels = sorted(list(datamodels)) self.story.tags.kill_chain_phases = sorted(list(kill_chain_phases)) From 9f2943793d1f199513df4f38fc1fe38842012b9f Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 6 Jun 2022 11:45:12 -0600 Subject: [PATCH 088/148] fixed cve number --- ...unauthenticated_remote_code_execution_cve_2022_26314.yml | 6 +++--- ...henticated_remote_code_execution_cve_2022_26314.test.yml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml index 7acaf4514f..630c635ba3 100644 --- a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml +++ b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml @@ -1,4 +1,4 @@ -name: Confluence Unauthenticated Remote Code Execution CVE-2022-26314 +name: Confluence Unauthenticated Remote Code Execution CVE-2022-26134 id: fcf4bd3f-a79f-4b7a-83bf-2692d60b859c version: 1 date: '2022-06-03' @@ -6,7 +6,7 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: The following analytic assists with identifying CVE-2022-26314 based exploitation utilizing the Web datamodel to cover network and CIM compliant web logs. The parameters were captured from live scanning and the POC provided by Rapid7. This analytic is written against multiple proof of concept codes released and see in the wild (scanning). +description: The following analytic assists with identifying CVE-2022-26134 based exploitation utilizing the Web datamodel to cover network and CIM compliant web logs. The parameters were captured from live scanning and the POC provided by Rapid7. This analytic is written against multiple proof of concept codes released and see in the wild (scanning). During triage, review any endpoint based logs for further activity including writing a jsp file to disk and commands/processes spawning running as root from the Confluence process. search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("*${*", "*%2F%7B*") (Web.url="*org.apache.commons.io.IOUtils*" Web.url="*java.lang.Runtime@getRuntime().exec*") OR (Web.url="*java.lang.Runtime%40getRuntime%28%29.exec*") OR (Web.url="*getEngineByName*" AND Web.url="*nashorn*" AND Web.url="*ProcessBuilder*") @@ -41,7 +41,7 @@ tags: impact: 100 kill_chain_phases: - Exploitation - message: A URL was requested related to CVE-2022-26314, a unauthenticated remote code execution vulnerability, on $dest$ by $src$. + message: A URL was requested related to CVE-2022-26134, a unauthenticated remote code execution vulnerability, on $dest$ by $src$. mitre_attack_id: - T1505 - T1190 diff --git a/tests/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.test.yml b/tests/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.test.yml index 5ec0a58ff2..b8104e23fc 100644 --- a/tests/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.test.yml +++ b/tests/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.test.yml @@ -1,7 +1,7 @@ -name: Confluence Unauthenticated Remote Code Execution CVE-2022-26314 Unit Test +name: Confluence Unauthenticated Remote Code Execution CVE-2022-26134 Unit Test tests: -- name: Confluence Unauthenticated Remote Code Execution CVE-2022-26314 - file: web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml +- name: Confluence Unauthenticated Remote Code Execution CVE-2022-26134 + file: web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now From e28a396af4267eee37450b01866651b73eae2375 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 6 Jun 2022 11:46:49 -0600 Subject: [PATCH 089/148] cve fix2 --- ...ce_unauthenticated_remote_code_execution_cve_2022_26134.yml} | 2 +- ...authenticated_remote_code_execution_cve_2022_26134.test.yml} | 0 2 files changed, 1 insertion(+), 1 deletion(-) rename detections/web/{confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml => confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml} (99%) rename tests/web/{confluence_unauthenticated_remote_code_execution_cve_2022_26314.test.yml => confluence_unauthenticated_remote_code_execution_cve_2022_26134.test.yml} (100%) diff --git a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml similarity index 99% rename from detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml rename to detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml index 630c635ba3..17c3aaf755 100644 --- a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml +++ b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml @@ -14,7 +14,7 @@ search: '| tstats count min(_time) as firstTime max(_time) | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `confluence_unauthenticated_remote_code_execution_cve_2022_26314_filter`' + | `confluence_unauthenticated_remote_code_execution_cve_2022_26134_filter`' how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache or Splunk for Nginx. In addition, network based logs or event data like PAN Threat. known_false_positives: Tune based on assets if possible, or restrict to known Confluence servers. Remove the ${ for a more broad query. To identify more exec, remove everything up to the last parameter (Runtime().exec) for a broad query. diff --git a/tests/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.test.yml b/tests/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.test.yml similarity index 100% rename from tests/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.test.yml rename to tests/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.test.yml From 6b84ec3bf3023cb65845deb960fedea4914cf601 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 6 Jun 2022 12:48:32 -0700 Subject: [PATCH 090/148] Update confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml --- ...nce_unauthenticated_remote_code_execution_cve_2022_26134.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml index 17c3aaf755..dd0f5134ec 100644 --- a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml +++ b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml @@ -6,7 +6,7 @@ author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: The following analytic assists with identifying CVE-2022-26134 based exploitation utilizing the Web datamodel to cover network and CIM compliant web logs. The parameters were captured from live scanning and the POC provided by Rapid7. This analytic is written against multiple proof of concept codes released and see in the wild (scanning). +description: The following analytic assists with identifying CVE-2022-26134 based exploitation utilizing the Web datamodel to cover network and CIM compliant web logs. The parameters were captured from live scanning and the POC provided by Rapid7. This analytic is written against multiple proof of concept codes released and seen in the wild (scanning). During triage, review any endpoint based logs for further activity including writing a jsp file to disk and commands/processes spawning running as root from the Confluence process. search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("*${*", "*%2F%7B*") (Web.url="*org.apache.commons.io.IOUtils*" Web.url="*java.lang.Runtime@getRuntime().exec*") OR (Web.url="*java.lang.Runtime%40getRuntime%28%29.exec*") OR (Web.url="*getEngineByName*" AND Web.url="*nashorn*" AND Web.url="*ProcessBuilder*") From 607b7a1e37d6fc3a3e49d0625df16ff3c73f92ed Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 6 Jun 2022 14:55:56 -0500 Subject: [PATCH 091/148] Updated macro to not rely on field extraction --- macros/splunkd_failed_auths.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/macros/splunkd_failed_auths.yml b/macros/splunkd_failed_auths.yml index 54a9027bb5..2cd71209e8 100644 --- a/macros/splunkd_failed_auths.yml +++ b/macros/splunkd_failed_auths.yml @@ -1,4 +1,4 @@ -definition: index=_audit action="login attempt" info="failed" +definition: index=_audit "action=login attempt" "info=failed" description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. name: splunkd_failed_auths \ No newline at end of file From 0fc379cbb3e0a3c8d4922ee16fddcff67cda77fe Mon Sep 17 00:00:00 2001 From: research bot Date: Mon, 6 Jun 2022 21:13:55 +0000 Subject: [PATCH 092/148] updating docs and package bits [ci skip] --- dist/escu/app.manifest | 2 +- dist/escu/default/analyticstories.conf | 49 ++++- dist/escu/default/app.conf | 4 +- dist/escu/default/collections.conf | 2 +- dist/escu/default/content-version.conf | 2 +- dist/escu/default/es_investigations.conf | 2 +- dist/escu/default/macros.conf | 12 +- dist/escu/default/savedsearches.conf | 140 ++++++++++--- dist/escu/default/transforms.conf | 2 +- dist/escu/default/workflow_actions.conf | 2 +- docs/_pages/detections.md | 4 +- docs/_pages/stories.md | 3 +- ...spectre_and_meltdown_vulnerable_systems.md | 2 +- ...12-detect_new_login_attempts_to_routers.md | 2 +- ...od_without_successful_netbackup_backups.md | 2 +- ...17-09-12-unsuccessful_netbackup_backups.md | 2 +- ...9-15-no_windows_updates_in_a_time_frame.md | 2 +- ...9-email_attachments_with_lots_of_spaces.md | 2 +- ...s_scanning_for_vulnerable_jboss_servers.md | 2 +- ...cious_requests_to_exploit_jboss_servers.md | 2 +- .../2017-09-23-monitor_dns_for_brand_abuse.md | 4 +- ...-23-monitor_web_traffic_for_brand_abuse.md | 2 +- .../2017-11-27-detect_usb_device_insertion.md | 2 +- ...018-01-05-monitor_email_for_brand_abuse.md | 2 +- ...21-detect_spike_in_network_acl_activity.md | 2 +- ...6-01-detect_large_outbound_icmp_packets.md | 2 +- ...18-06-28-detect_s3_access_from_a_new_ip.md | 2 +- ...8-11-02-windows_hosts_file_modification.md | 2 +- .../2018-12-03-remote_wmi_command_attempt.md | 2 +- .../_posts/2018-12-03-usn_journal_deletion.md | 2 +- .../2018-12-06-suspicious_java_classes.md | 2 +- .../2018-12-14-file_with_samsam_extension.md | 2 +- .../2018-12-14-samsam_test_file_write.md | 2 +- ...ide_files_directories_via_registry_keys.md | 2 +- ..._servers_executing_suspicious_processes.md | 2 +- .../2019-04-25-suspicious_file_write.md | 2 +- ...5-08-unusually_long_command_line_-_mltk.md | 2 +- ...9-10-11-prohibited_software_on_endpoint.md | 2 +- .../2019-12-10-creation_of_shadow_copy.md | 2 +- ...-01-22-dns_query_length_outliers_-_mltk.md | 2 +- ...20-02-07-macos_-_re-opened_applications.md | 2 +- .../2020-02-21-dump_lsass_via_comsvcs_dll.md | 2 +- ...03-02-remote_registry_key_modifications.md | 2 +- ...20-03-16-child_processes_of_spoolsv_exe.md | 2 +- .../2020-03-16-detect_rare_executables.md | 2 +- .../2020-03-16-process_execution_via_wmi.md | 2 +- .../2020-03-16-script_execution_via_wmi.md | 2 +- ...n_eks_kubernetes_cluster_scan_detection.md | 2 +- ...mazon_eks_kubernetes_pod_scan_detection.md | 2 +- ...5-gcp_kubernetes_cluster_scan_detection.md | 2 +- ...interception_by_creation_of_program_exe.md | 2 +- ...2020-07-06-short_lived_windows_accounts.md | 2 +- .../2020-07-06-windows_event_log_cleared.md | 2 +- ...20-07-07-remote_desktop_network_traffic.md | 2 +- ...-07-21-attempt_to_stop_security_service.md | 2 +- ..._to_phishing_sites_leveraging_evilginx2.md | 8 +- ...-detect_excessive_user_account_lockouts.md | 2 +- ...-21-detect_long_dns_txt_record_response.md | 2 +- .../2020-07-21-detect_outbound_smb_traffic.md | 2 +- ...1-detect_outlook_exe_writing_a_zip_file.md | 2 +- ...f_cmd_exe_to_launch_script_interpreters.md | 2 +- ...web_traffic_to_dynamic_domain_providers.md | 2 +- ...-21-detection_of_tools_built_by_nirsoft.md | 2 +- ...ce_modified_with_previously_unseen_user.md | 2 +- ...ritten_outside_of_the_outlook_directory.md | 2 +- ...1-first_time_seen_command_line_argument.md | 2 +- ...first_time_seen_running_windows_service.md | 2 +- ...g_files_and_directories_with_attrib_exe.md | 2 +- ...shell_process_-_execution_policy_bypass.md | 2 +- ...7-21-overwriting_accessibility_binaries.md | 2 +- ...7-21-prohibited_network_traffic_allowed.md | 2 +- .../2020-07-21-protocol_or_port_mismatch.md | 2 +- ...emote_desktop_process_running_on_system.md | 2 +- ...21-sc_exe_manipulating_windows_services.md | 2 +- ...uled_tasks_used_in_badrabbit_ransomware.md | 2 +- ...suspicious_changes_to_file_associations.md | 2 +- ...20-07-22-suspicious_email_-_uba_anomaly.md | 2 +- ...-suspicious_email_attachment_extensions.md | 2 +- .../2020-07-22-suspicious_reg_exe_process.md | 2 +- docs/_posts/2020-07-22-tor_traffic.md | 2 +- ...20-07-22-uncommon_processes_on_endpoint.md | 2 +- ...ct_windows_dns_sigred_via_splunk_stream.md | 2 +- ...ance_modified_by_previously_unseen_user.md | 2 +- ..._or_delete_windows_shares_using_net_exe.md | 2 +- ...ect_software_download_to_network_device.md | 2 +- .../2020-11-06-ryuk_test_files_detected.md | 2 +- ...windows_connhost_exe_started_forcefully.md | 2 +- ...indows_security_account_manager_stopped.md | 2 +- ...2020-11-09-common_ransomware_extensions.md | 2 +- .../2020-11-09-common_ransomware_notes.md | 2 +- .../2020-11-09-deleting_shadow_copies.md | 2 +- ...xcessive_account_lockouts_from_endpoint.md | 2 +- ..._system_network_configuration_discovery.md | 2 +- ...rohibited_applications_spawning_cmd_exe.md | 4 +- ...cution_of_file_with_multiple_extensions.md | 2 +- ...on_of_file_with_spaces_before_extension.md | 2 +- .../2020-11-23-processes_created_by_netsh.md | 2 +- ...installation_with_suspicious_parameters.md | 2 +- ...pulating_windows_services_registry_keys.md | 2 +- ...2-07-schtasks_used_for_forcing_a_reboot.md | 2 +- .../2020-12-08-shim_database_file_creation.md | 2 +- ...12-08-single_letter_process_on_endpoint.md | 2 +- ...processes_run_from_unexpected_locations.md | 2 +- .../2020-12-08-unusually_long_command_line.md | 2 +- ...1-bcdedit_failure_recovery_modification.md | 2 +- ...cious_microsoft_workflow_compiler_usage.md | 4 +- .../2021-01-12-suspicious_msbuild_spawn.md | 2 +- ...21-01-12-suspicious_mshta_child_process.md | 2 +- ..._connecting_to_dynamic_domain_providers.md | 2 +- ...ell_process_with_obfuscation_techniques.md | 2 +- ...cious_powershell_command-line_arguments.md | 2 +- ...20-detect_rundll32_inline_hta_execution.md | 2 +- .../2021-01-20-suspicious_mshta_spawn.md | 2 +- ...021-01-22-wbadmin_delete_system_backups.md | 2 +- ...-26-certutil_exe_certificate_extraction.md | 2 +- ...ect_regsvr32_application_control_bypass.md | 2 +- .../_posts/2021-01-28-ntdsutil_export_ntds.md | 2 +- ...cious_regsvr32_register_suspicious_path.md | 2 +- ...32_application_control_bypass_-_advpack.md | 2 +- ...2_application_control_bypass_-_setupapi.md | 2 +- ...2_application_control_bypass_-_syssetup.md | 2 +- .../2021-02-04-suspicious_rundll32_startw.md | 2 +- ...9-suspicious_rundll32_dllregisterserver.md | 2 +- ...11-detect_html_help_spawn_child_process.md | 2 +- ...-02-12-detect_regasm_spawning_a_process.md | 2 +- ...02-12-detect_regsvcs_spawning_a_process.md | 2 +- ...2-22-suspicious_curl_network_connection.md | 2 +- .../2021-02-22-suspicious_plistbuddy_usage.md | 2 +- ...uspicious_sqlite3_lsquarantine_behavior.md | 2 +- .../_posts/2021-03-01-fodhelper_uac_bypass.md | 2 +- .../2021-03-01-ryuk_wake_on_lan_command.md | 2 +- ...us_scheduled_task_from_public_directory.md | 2 +- ...ed_messaging_service_spawning_a_process.md | 2 +- ...-02-windows_disableantispyware_registry.md | 2 +- ...2021-03-03-nishang_powershelltcponeline.md | 2 +- docs/_posts/2021-03-03-w3wp_spawning_shell.md | 2 +- .../2021-03-12-resize_shadowstorage_volume.md | 2 +- .../2021-03-17-clop_common_exec_parameter.md | 2 +- ...3-17-clop_ransomware_known_service_name.md | 2 +- ...021-03-23-certutil_with_decode_argument.md | 2 +- ...021-03-29-powershell_start-bitstransfer.md | 2 +- ...021-03-31-disabling_firewall_with_netsh.md | 2 +- .../2021-03-31-dsquery_domain_discovery.md | 2 +- ...icious_powershell_executed_as_a_service.md | 2 +- .../2021-04-12-excel_spawning_powershell.md | 2 +- ...4-12-excel_spawning_windows_script_host.md | 2 +- .../2021-04-12-winword_spawning_powershell.md | 2 +- ...12-winword_spawning_windows_script_host.md | 2 +- ...fice_application_spawn_rundll32_process.md | 2 +- ...-15-dns_exfiltration_using_nslookup_app.md | 2 +- ...ocess_spawned_cmd_or_powershell_process.md | 2 +- ...ultiple_archive_files_http_post_traffic.md | 2 +- .../2021-04-22-anomalous_usage_of_7zip.md | 2 +- ...e_product_spawning_rundll32_with_no_dll.md | 2 +- ...-04-22-plain_http_post_exfiltrated_data.md | 2 +- .../_posts/2021-04-22-winword_spawning_cmd.md | 2 +- ...04-26-office_product_spawning_bitsadmin.md | 2 +- ...-04-26-office_product_spawning_certutil.md | 2 +- ...021-04-26-office_product_spawning_mshta.md | 2 +- docs/_posts/2021-04-29-icacls_deny_command.md | 2 +- .../2021-05-04-deleting_of_net_users.md | 2 +- .../2021-05-04-disabling_net_user_account.md | 2 +- ...4-excessive_attempt_to_disable_services.md | 2 +- ...21-05-04-excessive_service_stop_attempt.md | 2 +- .../2021-05-04-excessive_usage_of_taskkill.md | 2 +- .../_posts/2021-05-04-icacls_grant_command.md | 2 +- ...21-05-04-process_kill_base_on_file_path.md | 2 +- ...2021-05-05-suspicious_process_file_path.md | 2 +- .../2021-05-06-excessive_usage_of_net_app.md | 2 +- ...s_or_script_creation_in_suspicious_path.md | 2 +- ...2021-05-07-excessive_usage_of_cacls_app.md | 2 +- .../2021-05-07-schtasks_run_task_on_demand.md | 2 +- ...05-12-delete_shadowcopy_with_powershell.md | 2 +- docs/_posts/2021-05-13-slui_runas_elevated.md | 2 +- .../2021-05-13-slui_spawning_a_process.md | 2 +- .../2021-05-18-services_escalate_exe.md | 2 +- ...-allow_inbound_traffic_in_firewall_rule.md | 2 +- .../2021-05-19-mailsniper_invoke_functions.md | 2 +- .../2021-05-20-cmd_echo_pipe_-_escalation.md | 2 +- .../2021-05-21-winrm_spawning_a_process.md | 2 +- ...6-secretdumps_offline_ntds_dumping_tool.md | 2 +- ...27-detect_sharphound_file_modifications.md | 2 +- .../2021-05-27-detect_sharphound_usage.md | 2 +- ...etect_azurehound_command-line_arguments.md | 2 +- ...01-detect_azurehound_file_modifications.md | 2 +- ...etect_sharphound_command-line_arguments.md | 2 +- .../2021-06-02-conti_common_exec_parameter.md | 2 +- .../2021-06-02-revil_common_exec_parameter.md | 2 +- ...-04-known_services_killed_by_ransomware.md | 2 +- ...-excessive_number_of_taskhost_processes.md | 2 +- ...ss_process_injection_via_getprocaddress.md | 2 +- ..._script_contains_base64_encoded_content.md | 2 +- ...re_with_powershell_script_block_logging.md | 2 +- ...tz_with_powershell_script_block_logging.md | 2 +- ...021-06-09-unloading_amsi_via_reflection.md | 2 +- ...ear_unallocated_sector_using_cipher_app.md | 2 +- .../2021-06-10-disable_logs_using_wevtutil.md | 2 +- ...rmission_modification_using_takeown_app.md | 2 +- ...-06-10-powershell_creating_thread_mutex.md | 2 +- ...021-06-10-powershell_domain_enumeration.md | 2 +- ...ading_dotnet_into_memory_via_reflection.md | 2 +- ...10-powershell_processing_stream_of_data.md | 2 +- ...ent_automatic_repair_mode_using_bcdedit.md | 2 +- .../2021-06-10-recon_using_wmi_class.md | 2 +- ...4-wmi_recon_running_process_or_services.md | 2 +- ...ecute_javascript_with_jscript_com_clsid.md | 2 +- ...-powershell_enable_smb1protocol_feature.md | 2 +- ...ursive_delete_of_directory_in_batch_cmd.md | 2 +- ...w_file_and_printing_sharing_in_firewall.md | 2 +- ...-23-allow_network_discovery_in_firewall.md | 2 +- ...er_of_service_control_start_as_disabled.md | 2 +- ...1-print_spooler_adding_a_printer_driver.md | 2 +- ...-print_spooler_failed_to_load_a_plug-in.md | 2 +- .../2021-07-01-spoolsv_spawning_rundll32.md | 2 +- ...05-msmpeng_application_dll_side_loading.md | 2 +- ...-powershell_disable_security_monitoring.md | 2 +- ...tance_created_by_previously_unseen_user.md | 2 +- ...a_spawning_rundll32_or_regsvr32_process.md | 2 +- ...-07-19-office_product_spawn_cmd_process.md | 2 +- ...of_shadowcopy_with_script_block_logging.md | 2 +- ...7-26-suspicious_icedid_rundll32_cmdline.md | 2 +- ...21-07-26-suspicious_rundll32_plugininit.md | 2 +- .../2021-07-27-chcp_command_execution.md | 2 +- ...gsvr32_with_known_silent_switch_cmdline.md | 2 +- ...fice_application_spawn_regsvr32_process.md | 2 +- .../2021-08-09-uninstall_app_using_msiexec.md | 2 +- docs/_posts/2021-08-11-fsutil_zeroing_file.md | 2 +- ...8-17-7zip_commandline_to_smb_share_path.md | 2 +- docs/_posts/2021-08-18-esentutl_sam_copy.md | 2 +- ...ols_passing_authentication_in_cleartext.md | 2 +- ...1-08-20-github_commit_changes_in_master.md | 2 +- ...2021-08-23-getlocaluser_with_powershell.md | 2 +- ...twmiobject_user_account_with_powershell.md | 2 +- ...er_account_with_powershell_script_block.md | 2 +- ...21-08-24-adsisearcher_account_discovery.md | 2 +- ...4-domain_account_discovery_with_dsquery.md | 2 +- ...4-domain_account_discovery_with_net_app.md | 2 +- ...8-24-domain_account_discovery_with_wmic.md | 2 +- ...1-08-24-get-domaintrust_with_powershell.md | 2 +- ...omaintrust_with_powershell_script_block.md | 2 +- .../2021-08-24-get_aduser_with_powershell.md | 2 +- ...get_aduser_with_powershell_script_block.md | 2 +- ...21-08-24-get_domainuser_with_powershell.md | 2 +- ...24-getwmiobject_ds_user_with_powershell.md | 2 +- ...ct_ds_user_with_powershell_script_block.md | 2 +- ...-08-24-kubernetes_scanner_image_pulling.md | 2 +- ...omain_group_discovery_with_adsisearcher.md | 2 +- ...1-08-25-domain_group_discovery_with_net.md | 2 +- ...-08-25-domain_group_discovery_with_wmic.md | 2 +- ...08-25-elevated_group_discovery_with_net.md | 2 +- ...elevated_group_discovery_with_powerview.md | 2 +- ...8-25-elevated_group_discovery_with_wmic.md | 2 +- .../2021-08-25-getadgroup_with_powershell.md | 2 +- ...21-08-25-getdomaingroup_with_powershell.md | 2 +- ...-25-getnettcpconnection_with_powershell.md | 2 +- ...5-getwmiobject_ds_group_with_powershell.md | 2 +- ...t_ds_group_with_powershell_script_block.md | 2 +- ...ultdomainpasswordpolicy_with_powershell.md | 2 +- ...resultantpasswordpolicy_with_powershell.md | 2 +- ...wordpolicy_with_powershell_script_block.md | 2 +- ...-08-26-get_domainpolicy_with_powershell.md | 2 +- ...mainpolicy_with_powershell_script_block.md | 2 +- ...omaingroup_with_powershell_script_block.md | 2 +- ...8-26-password_policy_discovery_with_net.md | 2 +- ...reating_lnk_file_in_suspicious_location.md | 2 +- ...8-27-exchange_powershell_abuse_via_ssrf.md | 2 +- ...-08-27-exchange_powershell_module_usage.md | 2 +- ...domain_controller_discovery_with_nltest.md | 2 +- ...-08-30-remote_system_discovery_with_net.md | 2 +- ...31-remote_system_discovery_with_dsquery.md | 2 +- ...1-09-01-circle_ci_disable_security_step.md | 2 +- ...1-domain_controller_discovery_with_wmic.md | 2 +- ...-01-domain_group_discovery_with_dsquery.md | 2 +- ...adcomputer_with_powershell_script_block.md | 2 +- ...s_computer_with_powershell_script_block.md | 2 +- .../2021-09-01-github_commit_in_develop.md | 2 +- .../2021-09-01-github_dependabot_alert.md | 2 +- ...1-github_pull_request_from_unknown_user.md | 2 +- ...mote_system_discovery_with_adsisearcher.md | 2 +- ...09-01-remote_system_discovery_with_wmic.md | 2 +- ...21-09-02-circle_ci_disable_security_job.md | 2 +- ...1-09-02-get-foresttrust_with_powershell.md | 2 +- ...oresttrust_with_powershell_script_block.md | 2 +- ...incomputer_with_powershell_script_block.md | 2 +- ...controller_with_powershell_script_block.md | 2 +- ...cdedit_command_back_to_normal_mode_boot.md | 2 +- ...change_to_safe_mode_with_network_config.md | 2 +- ...021-09-07-getadcomputer_with_powershell.md | 2 +- ...09-07-getdomaincomputer_with_powershell.md | 2 +- ...-07-getdomaincontroller_with_powershell.md | 2 +- ...etwmiobject_ds_computer_with_powershell.md | 2 +- ...-system_information_discovery_detection.md | 2 +- ...l_loading_from_world_writable_directory.md | 2 +- ...eate_local_admin_accounts_using_net_exe.md | 2 +- .../2021-09-08-office_spawning_control.md | 2 +- ...2021-09-08-rundll32_control_rundll_hunt.md | 2 +- ...control_rundll_world_writable_directory.md | 2 +- ...2021-09-09-extraction_of_registry_hives.md | 2 +- ...connection_with_powershell_script_block.md | 2 +- ...0-network_connection_discovery_with_arp.md | 2 +- ...0-network_connection_discovery_with_net.md | 2 +- ...twork_connection_discovery_with_netstat.md | 2 +- ...1-09-13-getcurrent_user_with_powershell.md | 2 +- ...-13-jscript_execution_using_cscript_app.md | 2 +- ...-09-13-system_user_discovery_with_query.md | 2 +- ...09-13-system_user_discovery_with_whoami.md | 2 +- ...user_discovery_with_env_vars_powershell.md | 2 +- ...21-09-13-xsl_script_execution_with_wmic.md | 2 +- ...-cmdline_tool_not_executed_in_cmd_shell.md | 2 +- ...021-09-14-get_wmiobject_group_discovery.md | 2 +- .../2021-09-14-net_localgroup_discovery.md | 2 +- ...-14-powershell_get_localgroup_discovery.md | 2 +- ...oup_discovery_with_script_block_logging.md | 2 +- .../_posts/2021-09-14-wmic_group_discovery.md | 2 +- ...1-09-15-check_elevated_cmd_using_whoami.md | 2 +- ...21-09-16-account_discovery_with_net_app.md | 2 +- ...t_to_add_certificate_to_untrusted_store.md | 2 +- ...edential_dump_from_registry_via_reg_exe.md | 4 +- .../_posts/2021-09-16-bits_job_persistence.md | 2 +- .../2021-09-16-bitsadmin_download_file.md | 2 +- ...of_shadow_copy_with_wmic_and_powershell.md | 2 +- ...mping_via_copy_command_from_shadow_copy.md | 2 +- ...tial_dumping_via_symlink_to_shadow_copy.md | 2 +- ...16-detect_html_help_url_in_command_line.md | 2 +- ...ml_help_using_infotech_storage_handlers.md | 2 +- ...09-16-detect_mshta_inline_hta_execution.md | 2 +- ...-09-16-detect_mshta_url_in_command_line.md | 2 +- ...9-16-detect_psexec_with_accepteula_flag.md | 2 +- .../_posts/2021-09-16-detect_renamed_7-zip.md | 2 +- .../2021-09-16-detect_renamed_rclone.md | 2 +- .../2021-09-16-detect_renamed_winrar.md | 2 +- .../2021-09-16-dump_lsass_via_procdump.md | 2 +- ...-09-16-local_account_discovery_with_net.md | 2 +- ...09-16-local_account_discovery_with_wmic.md | 2 +- ...2021-09-16-office_product_spawning_wmic.md | 2 +- .../2021-09-16-processes_launching_netsh.md | 2 +- ...ument_spawned_child_process_to_download.md | 2 +- ...mcos_rat_file_creation_in_remcos_folder.md | 2 +- ...1-09-27-change_default_file_association.md | 2 +- ...27-logon_script_event_trigger_execution.md | 2 +- ...-27-screensaver_event_trigger_execution.md | 2 +- ...9-28-print_processor_registry_autostart.md | 2 +- .../2021-09-29-verclsid_clsid_execution.md | 4 +- ...01-vbscript_execution_using_wscript_app.md | 2 +- ...ld_suspicious_spawned_by_script_process.md | 2 +- ...32_silent_and_install_param_dll_loading.md | 2 +- ...5-malicious_inprocserver32_modification.md | 2 +- ...1-10-05-process_writing_dynamicwrapperx.md | 2 +- .../2021-10-05-rundll32_shimcache_flush.md | 2 +- .../2021-10-05-suspicious_copy_on_system32.md | 2 +- .../2021-10-05-winhlp32_spawning_a_process.md | 2 +- ...021-10-06-sdelete_application_execution.md | 2 +- ...ipt_or_cscript_suspicious_child_process.md | 2 +- .../2021-10-11-suspicious_wevtutil_usage.md | 2 +- ...rincipalnames_discovery_with_powershell.md | 2 +- ...iceprincipalnames_discovery_with_setspn.md | 2 +- .../2021-10-18-disable_schedule_task.md | 2 +- ...indows_curl_download_to_suspicious_path.md | 4 +- ...-wmic_noninteractive_app_uninstallation.md | 2 +- docs/_posts/2021-11-03-windows_adfind_exe.md | 2 +- .../2021-11-04-attacker_tools_on_endpoint.md | 2 +- ...ndows_curl_upload_to_remote_destination.md | 4 +- ...ows_service_creation_on_remote_endpoint.md | 2 +- ...s_service_initiation_on_remote_endpoint.md | 2 +- ...ocess_instantiation_via_winrm_and_winrs.md | 2 +- ...sk_creation_on_remote_endpoint_using_at.md | 2 +- ...uled_task_initiation_on_remote_endpoint.md | 2 +- .../2021-11-11-wmic_xsl_execution_via_url.md | 2 +- ...21-11-12-csc_net_on_the_fly_compilation.md | 2 +- ...1-11-12-firewall_allowed_program_enable.md | 2 +- ...twork_discovery_using_route_windows_app.md | 2 +- ...12-remote_process_instantiation_via_wmi.md | 2 +- ...21-11-12-runas_execution_in_commandline.md | 2 +- ...12-windows_installutil_uninstall_option.md | 2 +- ...windows_installutil_url_in_command_line.md | 2 +- ...s_instantiation_via_dcom_and_powershell.md | 2 +- ...ss_instantiation_via_wmi_and_powershell.md | 2 +- ...ion_via_wmi_and_powershell_script_block.md | 2 +- .../2021-11-15-windows_diskcryptor_usage.md | 2 +- ..._instantiation_via_winrm_and_powershell.md | 2 +- ...2021-11-17-windows_dism_remove_defender.md | 2 +- ...info_gathering_using_dxdiag_application.md | 2 +- ...22-possible_browser_pass_view_parameter.md | 2 +- ...services_lolbas_execution_process_spawn.md | 2 +- ...-svchost_lolbas_execution_process_spawn.md | 2 +- ...ce_created_with_suspicious_service_path.md | 2 +- ...dows_service_created_within_public_path.md | 2 +- ...wmiprsve_lolbas_execution_process_spawn.md | 2 +- ...provhost_lolbas_execution_process_spawn.md | 2 +- ...1-23-mmc_lolbas_execution_process_spawn.md | 2 +- ...5-add_or_set_windows_defender_exclusion.md | 2 +- ...ell_windows_defender_exclusion_commands.md | 2 +- ...-11-29-detect_rclone_command-line_usage.md | 2 +- ...sible_lateral_movement_powershell_spawn.md | 2 +- ...-06-suspicious_linux_discovery_commands.md | 2 +- ...windows_raccine_scheduled_task_deletion.md | 2 +- ...-12-10-curl_download_and_bash_execution.md | 2 +- ...-12-11-wget_download_and_bash_execution.md | 2 +- .../2021-12-13-linux_java_spawning_shell.md | 2 +- ...load_injection_with_outbound_connection.md | 2 +- ...onnection_from_java_using_default_ports.md | 2 +- ...2021-12-13-windows_java_spawning_shells.md | 4 +- ..._add_files_in_known_crontab_directories.md | 2 +- ...-17-linux_at_allow_config_file_creation.md | 2 +- ...1-12-17-linux_edit_cron_table_parameter.md | 2 +- ..._cronjob_entry_on_existing_cronjob_file.md | 2 +- ...ssible_cronjob_modification_with_editor.md | 2 +- ...ux_file_creation_in_init_boot_directory.md | 2 +- ...inux_file_creation_in_profile_directory.md | 2 +- ...e_append_command_to_profile_config_file.md | 2 +- ...rvice_file_created_in_systemd_directory.md | 2 +- .../2021-12-20-linux_service_restarted.md | 2 +- ...-12-20-linux_service_started_or_enabled.md | 2 +- .../2021-12-21-linux_add_user_account.md | 2 +- ...1-12-21-linux_change_file_owner_to_root.md | 2 +- ...21-linux_nopasswd_entry_in_sudoers_file.md | 2 +- ...-12-21-linux_setuid_using_chmod_utility.md | 2 +- ...12-21-linux_setuid_using_setcap_utility.md | 2 +- ...21-12-21-linux_visudo_utility_execution.md | 2 +- ...file_created_in_kernel_driver_directory.md | 2 +- ...sert_kernel_module_using_insmod_utility.md | 2 +- ...ll_kernel_module_using_modprobe_utility.md | 2 +- ...2-22-linux_preload_hijack_library_calls.md | 2 +- ...ux_common_process_for_elevation_control.md | 2 +- ...1-12-23-linux_sudoers_tmp_file_creation.md | 2 +- .../2022-01-04-linux_sudo_or_su_execution.md | 2 +- ...022-01-05-linux_doas_conf_file_creation.md | 2 +- .../2022-01-05-linux_doas_tool_execution.md | 2 +- ...nux_possible_access_to_credential_files.md | 2 +- ...0-linux_possible_access_to_sudoers_file.md | 2 +- ...ess_or_modification_of_sshd_config_file.md | 2 +- ...11-linux_possible_ssh_key_file_creation.md | 2 +- ..._connect_to_internet_with_hidden_window.md | 2 +- ...tentially_malicious_code_on_commandline.md | 2 +- ...-cmd_carry_out_string_command_parameter.md | 2 +- ...lateral_movement_commandline_parameters.md | 2 +- ...us_powershell_process_-_encoded_command.md | 2 +- ...shell_remove_windows_defender_directory.md | 2 +- ...dows_dotnet_binary_in_non_standard_path.md | 2 +- ...indows_installutil_in_non_standard_path.md | 2 +- .../2022-01-20-ping_sleep_batch_command.md | 2 +- .../2022-01-21-windows_nirsoft_advancedrun.md | 2 +- .../2022-01-24-windows_nirsoft_utilities.md | 2 +- ...6-log4shell_cve-2021-44228_exploitation.md | 2 +- ...01-28-linux_pkexec_privilege_escalation.md | 2 +- ...tz_passtheticket_commandline_parameters.md | 2 +- ...22-02-01-rubeus_command_line_parameters.md | 2 +- ...nload_with_urlcache_and_split_arguments.md | 2 +- ...load_with_verifyctl_and_split_arguments.md | 2 +- ...dows_remote_assistance_spawning_process.md | 4 +- ...7-windows_schtasks_create_run_as_system.md | 2 +- ...022-02-08-rundll_loading_dll_by_ordinal.md | 2 +- .../2022-02-14-linux_dd_file_overwrite.md | 2 +- ...2-15-windows_diskshadow_proxy_execution.md | 2 +- ...22-02-15-windows_rasautou_dll_execution.md | 2 +- ...authentication_discovery_with_powerview.md | 2 +- .../2022-02-18-net_profiler_uac_bypass.md | 2 +- ...cution_policy_to_unrestricted_or_bypass.md | 2 +- ...uthentication_discovery_with_get-aduser.md | 2 +- ...heduled_task_deleted_or_created_via_cmd.md | 2 +- ...2-02-22-windows_wmi_process_call_create.md | 2 +- ...ndows_excessive_disabled_services_event.md | 2 +- ...dows_process_with_namedpipe_commandline.md | 2 +- ...le_without_extension_in_critical_folder.md | 2 +- ...ve_distinct_processes_from_windows_temp.md | 2 +- .../2022-03-08-suspicious_msbuild_path.md | 2 +- ...own_process_using_the_kerberos_protocol.md | 2 +- ...t_regasm_with_no_command_line_arguments.md | 2 +- ..._regsvcs_with_no_command_line_arguments.md | 4 +- ..._no_command_line_arguments_with_network.md | 2 +- ..._no_command_line_arguments_with_network.md | 2 +- ..._no_command_line_arguments_with_network.md | 2 +- ...lhost_with_no_command_line_with_network.md | 2 +- ...cious_dllhost_no_command_line_arguments.md | 4 +- ...ious_gpupdate_no_command_line_arguments.md | 2 +- ...ious_rundll32_no_command_line_arguments.md | 2 +- ...hprotocolhost_no_command_line_arguments.md | 2 +- ...s_installutil_remote_network_connection.md | 2 +- ...stallutil_uninstall_option_with_network.md | 2 +- ...odify_acl_permission_to_files_or_folder.md | 2 +- ...wordpolicy_with_powershell_script_block.md | 2 +- ...domainuser_with_powershell_script_block.md | 2 +- ...oup_discovery_with_script_block_logging.md | 2 +- ...getadgroup_with_powershell_script_block.md | 2 +- ...rrent_user_with_powershell_script_block.md | 2 +- ...tlocaluser_with_powershell_script_block.md | 2 +- ...sion_on_remote_endpoint_with_powershell.md | 2 +- ...ntication_flag_disabled_with_powershell.md | 2 +- ...022-03-22-powershell_execute_com_object.md | 2 +- ...owershell_using_memory_as_backing_store.md | 2 +- ...3-22-recon_avproduct_through_pwh_or_wmi.md | 2 +- ...on_via_dcom_and_powershell_script_block.md | 2 +- ...n_via_winrm_and_powershell_script_block.md | 2 +- ...y_with_env_vars_powershell_script_block.md | 2 +- ...uter_unconstrained_delegation_discovery.md | 2 +- ...view_unconstrained_delegation_discovery.md | 2 +- ...022-03-29-windows_iso_lnk_file_creation.md | 2 +- ...erview_constrained_delegation_discovery.md | 2 +- ...ithub_actions_disable_security_workflow.md | 2 +- ...4-windows_driver_load_non-standard_path.md | 2 +- ...4-04-windows_event_for_service_disabled.md | 2 +- ...nux_stdout_redirection_to_dev_null_file.md | 2 +- ...indirect_command_execution_via_forfiles.md | 2 +- ...s_indirect_command_execution_via_pcalua.md | 2 +- ..._spring4shell_http_request_class_module.md | 2 +- .../2022-04-07-any_powershell_downloadfile.md | 2 +- ...022-04-07-any_powershell_downloadstring.md | 2 +- .../2022-04-07-detect_html_help_renamed.md | 2 +- .../_posts/2022-04-07-detect_mshta_renamed.md | 2 +- .../2022-04-07-detect_renamed_psexec.md | 2 +- ...ious_microsoft_workflow_compiler_rename.md | 2 +- .../2022-04-07-suspicious_msbuild_rename.md | 2 +- .../2022-04-07-suspicious_rundll32_rename.md | 2 +- ...2-04-13-windows_registry_delete_task_sd.md | 2 +- ...022-04-18-nltest_domain_trust_discovery.md | 2 +- ...nux_adding_crontab_using_list_parameter.md | 2 +- ...ing_critical_directory_using_rm_command.md | 2 +- .../2022-04-22-linux_disable_services.md | 2 +- ...022-04-22-linux_shred_overwrite_command.md | 2 +- docs/_posts/2022-04-22-linux_stop_services.md | 2 +- ...ndows_linked_policies_in_adsi_discovery.md | 2 +- ...s_root_domain_linked_policies_discovery.md | 2 +- ...2022-04-29-path_traversal_spl_injection.md | 2 +- ...worker_process_in_writable_process_path.md | 2 +- ...-02-windows_krbrelayup_service_creation.md | 2 +- ...ndows_service_create_kernel_mode_driver.md | 2 +- .../2022-05-16-windows_system_file_on_disk.md | 2 +- ...chtasks_scheduling_job_on_remote_system.md | 2 +- ...22-05-26-linux_at_application_execution.md | 2 +- ..._append_command_to_at_allow_config_file.md | 2 +- ...ws_execute_arbitrary_commands_with_msdt.md | 20 +- ...30-windows_office_product_spawning_msdt.md | 6 +- .../2022-06-01-unload_sysmon_filter_driver.md | 168 ++++++++++++++++ ...ting_interpreter_hunting_path_traversal.md | 175 ++++++++++++++++ ...ripting_interpreter_path_traversal_exec.md | 170 ++++++++++++++++ ...ed_remote_code_execution_cve-2022-26134.md | 176 ++++++++++++++++ ...2-06-03-excessive_usage_of_nslookup_app.md | 165 +++++++++++++++ .../2022-06-03-java_writing_jsp_file.md | 188 ++++++++++++++++++ ...03-linux_iptables_firewall_modification.md | 179 +++++++++++++++++ ...e_server_and_data_center_cve-2022-26134.md | 46 +++++ ...ostic_tool_vulnerability_cve-2022-30190.md | 3 +- .../windows_defense_evasion_tactics.md | 1 + docs/mitre-map/coverage.json | 22 +- 543 files changed, 2002 insertions(+), 605 deletions(-) create mode 100644 docs/_posts/2022-06-01-unload_sysmon_filter_driver.md create mode 100644 docs/_posts/2022-06-01-windows_command_and_scripting_interpreter_hunting_path_traversal.md create mode 100644 docs/_posts/2022-06-01-windows_command_and_scripting_interpreter_path_traversal_exec.md create mode 100644 docs/_posts/2022-06-03-confluence_unauthenticated_remote_code_execution_cve-2022-26134.md create mode 100644 docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md create mode 100644 docs/_posts/2022-06-03-java_writing_jsp_file.md create mode 100644 docs/_posts/2022-06-03-linux_iptables_firewall_modification.md create mode 100644 docs/_stories/atlassian_confluence_server_and_data_center_cve-2022-26134.md diff --git a/dist/escu/app.manifest b/dist/escu/app.manifest index 41536b0767..731920e356 100644 --- a/dist/escu/app.manifest +++ b/dist/escu/app.manifest @@ -5,7 +5,7 @@ "id": { "group": null, "name": "DA-ESS-ContentUpdate", - "version": "3.41.0" + "version": "3.42.0" }, "author": [ { diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf index a249152145..dba4e07934 100644 --- a/dist/escu/default/analyticstories.conf +++ b/dist/escu/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-05-31T17:59:08 UTC +# On Date: 2022-06-06T20:50:08 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -4008,7 +4008,7 @@ providing_technologies = [] type = detection asset_type = Endpoint confidence = medium -explanation = The following analytic identifies the process java writing a .jsp to disk. This is potentially indicative of a web shell being written to disk. +explanation = The following analytic identifies the process java writing a .jsp to disk. This is potentially indicative of a web shell being written to disk. Modify and tune the analytic based on data ingested. For instance, it may be worth running a broad query for jsp file writes first before performing a join. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]} known_false_positives = False positives are possible and filtering may be required. Restrict by assets or filter known jsp files that are common for the environment. @@ -6815,12 +6815,12 @@ providing_technologies = [] [savedsearch://ESCU - Unload Sysmon Filter Driver - Rule] type = detection -asset_type = +asset_type = Endpoint confidence = medium explanation = Attackers often disable security tools to avoid detection. This search looks for the usage of process `fltMC.exe` to unload a Sysmon Driver that will stop sysmon from collecting the data. how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. This search is also shipped with `unload_sysmon_filter_driver_filter` macro, update this macro to filter out false positives. annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"]} -known_false_positives = +known_false_positives = Unknown at the moment providing_technologies = [] [savedsearch://ESCU - Unloading AMSI via Reflection - Rule] @@ -6976,11 +6976,21 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre known_false_positives = administrators rarely use adfind, usually not used for legitimate reasons providing_technologies = [] +[savedsearch://ESCU - Windows Command and Scripting Interpreter Hunting Path Traversal - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies path traversal command-line execution and should be used to tune and driver other more higher fidelity analytics. This technique was seen in malicious document that execute malicious code using msdt.exe and path traversal technique that serve as defense evasion. This Hunting query is a good pivot to look for possible suspicious process and command-line that runs execute path traversal technique to run malicious code. This may help you to find possible downloaded malware or other lolbin execution. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]} +known_false_positives = false positive may vary depends on the score you want to check. The bigger number of path traversal string count the better. +providing_technologies = [] + [savedsearch://ESCU - Windows Command and Scripting Interpreter Path Traversal Exec - Rule] type = detection asset_type = Endpoint confidence = medium -explanation = The following analytic identifies path traversal commandline execution. This technique was seen in malicious document that execute malicious code using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and commandline that runs before and after this execution. This may help you to find possible downloaded malware or other lolbin execution. +explanation = The following analytic identifies path traversal command-line execution. This technique was seen in malicious document that execute malicious code using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and command-line that runs before and after this execution. This may help you to find possible downloaded malware or other lolbin execution. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]} known_false_positives = Not known at this moment. @@ -7251,8 +7261,8 @@ asset_type = Endpoint confidence = medium explanation = The following analytic identifies a recently disclosed arbitraty command execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve a remote payload. During triage, review file modifications for html. Identify parallel process execution that may be related, including an Office Product. how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1202"], "nist": ["DE.CM"]} -known_false_positives = False positives may be present, filter as needed. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218"], "nist": ["DE.CM"]} +known_false_positives = False positives may be present, filter as needed. Added .xml to potentially capture any answer file usage. Remove as needed. providing_technologies = [] [savedsearch://ESCU - Windows File Without Extension In Critical Folder - Rule] @@ -9089,6 +9099,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.00 known_false_positives = unknown providing_technologies = [] +[savedsearch://ESCU - Confluence Unauthenticated Remote Code Execution CVE-2022-26134 - Rule] +type = detection +asset_type = Web Server +confidence = medium +explanation = The following analytic assists with identifying CVE-2022-26134 based exploitation utilizing the Web datamodel to cover network and CIM compliant web logs. The parameters were captured from live scanning and the POC provided by Rapid7. This analytic is written against multiple proof of concept codes released and seen in the wild (scanning). During triage, review any endpoint based logs for further activity including writing a jsp file to disk and commands/processes spawning running as root from the Confluence process. +how_to_implement = This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache or Splunk for Nginx. In addition, network based logs or event data like PAN Threat. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1190"], "nist": ["DE.CM"]} +known_false_positives = Tune based on assets if possible, or restrict to known Confluence servers. Remove the ${ for a more broad query. To identify more exec, remove everything up to the last parameter (Runtime().exec) for a broad query. +providing_technologies = [] + [savedsearch://ESCU - Log4Shell JNDI Payload Injection Attempt - Rule] type = detection asset_type = Endpoint @@ -9281,6 +9301,17 @@ searches = ["ESCU - Detect Unauthorized Assets by MAC address - Rule", "ESCU - G description = Keep a careful inventory of every asset on your network to make it easier to detect rogue devices. Unauthorized/unmanaged devices could be an indication of malicious behavior that should be investigated further. narrative = This Analytic Story is designed to help you develop a better understanding of what authorized and unauthorized devices are part of your enterprise. This story can help you better categorize and classify assets, providing critical business context and awareness of their assets during an incident. Information derived from this Analytic Story can be used to better inform and support other analytic stories. For successful detection, you will need to leverage the Assets and Identity Framework from Enterprise Security to populate your known assets. +[analytic_story://Atlassian Confluence Server and Data Center CVE-2022-26134] +category = Adversary Tactics +last_updated = 2022-06-03 +version = 1 +references = ["https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html", "https://www.splunk.com/en_us/blog/security/atlassian-confluence-vulnerability-cve-2022-26134.html", "https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/", "https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] +spec_version = 3 +searches = ["ESCU - Java Writing JSP File - Rule", "ESCU - Confluence Unauthenticated Remote Code Execution CVE-2022-26134 - Rule"] +description = On June 2, security researchers at Volexity published a blog outlining the discovery of an unauthenticated remote code execution zero day vulnerability (CVE-2022-26134) being actively exploited in Atlassian Confluence Server and Data Center instances in the wild. Atlassian released a fix within 24 hours of the blog''s release. +narrative = Atlassian describes the vulnerability as an Object-Graph Navigation Language (OGNL) injection allowing an unauthenticated user to execute arbitrary code on a Confluence Server or Data Server instance. Volexity did not release proof-of-concept (POC) exploit code, but researchers there have observed coordinated, widespread exploitation. Volexity first discovered the vulnerability over the weekend on two Internet-facing web servers running Confluence Server software. The investigation was due to suspicious activity on the hosts, including JSP webshells that were written to disk. + [analytic_story://AWS Cross Account Activity] category = Cloud Security last_updated = 2018-06-04 @@ -10126,7 +10157,7 @@ version = 1 references = ["https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/", "https://isc.sans.edu/diary/rss/28694", "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e", "https://twitter.com/nao_sec/status/1530196847679401984?s=20\u0026t=ZiXYI4dQuA-0_dzQzSUb3A", "https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/", "https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection", "https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html"] maintainers = [{"company": "Teoderick Contreras, Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Windows Command and Scripting Interpreter Path Traversal Exec - Rule", "ESCU - Windows Execute Arbitrary Commands with MSDT - Rule", "ESCU - Windows Office Product Spawning MSDT - Rule"] +searches = ["ESCU - Windows Command and Scripting Interpreter Hunting Path Traversal - Rule", "ESCU - Windows Command and Scripting Interpreter Path Traversal Exec - Rule", "ESCU - Windows Execute Arbitrary Commands with MSDT - Rule", "ESCU - Windows Office Product Spawning MSDT - Rule"] description = On Monday May 30, 2022, Microsoft issued CVE-2022-30190 regarding the Microsoft Support Diagnostic Tool (MSDT) in Windows vulnerability. narrative = A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user''s rights. @@ -10841,7 +10872,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Defense_Evasion"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Add or Set Windows Defender Exclusion - Rule", "ESCU - CSC Net On The Fly Compilation - Rule", "ESCU - Disable Registry Tool - Rule", "ESCU - Disable Security Logs Using MiniNt Registry - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - Firewall Allowed Program Enable - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Powershell Windows Defender Exclusion Commands - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - Windows Command and Scripting Interpreter Path Traversal Exec - Rule", "ESCU - Windows Defender Exclusion Registry Entry - Rule", "ESCU - Windows Disable Change Password Through Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable Notification Center - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows DISM Remove Defender - Rule", "ESCU - Windows Event For Service Disabled - Rule", "ESCU - Windows Excessive Disabled Services Event - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule", "ESCU - Windows Process With NamedPipe CommandLine - Rule", "ESCU - Windows Rasautou DLL Execution - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Add or Set Windows Defender Exclusion - Rule", "ESCU - CSC Net On The Fly Compilation - Rule", "ESCU - Disable Registry Tool - Rule", "ESCU - Disable Security Logs Using MiniNt Registry - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable UAC Remote Restriction - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - Firewall Allowed Program Enable - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Powershell Windows Defender Exclusion Commands - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - Windows Command and Scripting Interpreter Hunting Path Traversal - Rule", "ESCU - Windows Command and Scripting Interpreter Path Traversal Exec - Rule", "ESCU - Windows Defender Exclusion Registry Entry - Rule", "ESCU - Windows Disable Change Password Through Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable Notification Center - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows DISM Remove Defender - Rule", "ESCU - Windows Event For Service Disabled - Rule", "ESCU - Windows Excessive Disabled Services Event - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule", "ESCU - Windows Process With NamedPipe CommandLine - Rule", "ESCU - Windows Rasautou DLL Execution - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms. diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf index cb04e698c1..f3e75d5dc0 100644 --- a/dist/escu/default/app.conf +++ b/dist/escu/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 8031 +build = 8166 [triggers] reload.analytic_stories = simple @@ -20,7 +20,7 @@ reload.es_investigations = simple [launcher] author = Splunk -version = 3.41.0 +version = 3.42.0 description = Explore the Analytic Stories included with ES Content Updates. [ui] diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index bb31722eed..6385ce639b 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-05-31T17:59:08 UTC +# On Date: 2022-06-06T20:50:08 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/content-version.conf b/dist/escu/default/content-version.conf index 0ad1a936ff..305cdc9464 100644 --- a/dist/escu/default/content-version.conf +++ b/dist/escu/default/content-version.conf @@ -1,2 +1,2 @@ [content-version] -version = 3.41.0 +version = 3.42.0 diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf index 5f17437416..b38bf7c285 100644 --- a/dist/escu/default/es_investigations.conf +++ b/dist/escu/default/es_investigations.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-05-31T17:59:08 UTC +# On Date: 2022-06-06T20:50:08 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 86135c0ec1..330a659e90 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-05-31T17:59:08 UTC +# On Date: 2022-06-06T20:50:08 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -2733,6 +2733,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[windows_command_and_scripting_interpreter_hunting_path_traversal_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [windows_command_and_scripting_interpreter_path_traversal_exec_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -3541,6 +3545,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[confluence_unauthenticated_remote_code_execution_cve_2022_26134_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [log4shell_jndi_payload_injection_attempt_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -4068,7 +4076,7 @@ definition = index=_internal sourcetype=splunkd description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [splunkd_failed_auths] -definition = index=_audit action="login attempt" info="failed" +definition = index=_audit "action=login attempt" "info=failed" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [splunkd_web] diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 2eba44ba3a..806359d4a1 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-05-31T17:59:08 UTC +# On Date: 2022-06-06T20:50:08 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -14349,8 +14349,8 @@ action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of nslookup.exe may be used. action.escu.known_false_positives = unknown -action.escu.creation_date = 2021-04-21 -action.escu.modification_date = 2021-04-21 +action.escu.creation_date = 2022-06-03 +action.escu.modification_date = 2022-06-03 action.escu.confidence = high action.escu.full_search_name = ESCU - Excessive Usage of NSLOOKUP App - Rule action.escu.search_type = detection @@ -14378,7 +14378,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventCode = 1 process_name = "nslookup.exe" | bucket _time span=15m | stats count as numNsLookup by Computer, _time | eventstats avg(numNsLookup) as avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer | eval upperThreshold=(avgNsLookup + stdNsLookup *3) | eval isOutlier=if(avgNsLookup > 20 and avgNsLookup >= upperThreshold, 1, 0) | search isOutlier=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_nslookup_app_filter` +search = `sysmon` EventCode = 1 process_name = "nslookup.exe" | bucket _time span=1m | stats count as numNsLookup by Computer, _time | eventstats avg(numNsLookup) as avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer | eval upperThreshold=(avgNsLookup + stdNsLookup *3) | eval isOutlier=if(numNsLookup > 20 and numNsLookup >= upperThreshold, 1, 0) | search isOutlier=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_nslookup_app_filter` [ESCU - Excessive Usage Of SC Service Utility - Rule] action.escu = 0 @@ -17173,20 +17173,20 @@ search = | tstats count from datamodel=Web where Web.http_user_agent="*Java*" We [ESCU - Java Writing JSP File - Rule] action.escu = 0 action.escu.enabled = 1 -description = The following analytic identifies the process java writing a .jsp to disk. This is potentially indicative of a web shell being written to disk. +description = The following analytic identifies the process java writing a .jsp to disk. This is potentially indicative of a web shell being written to disk. Modify and tune the analytic based on data ingested. For instance, it may be worth running a broad query for jsp file writes first before performing a join. action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = The following analytic identifies the process java writing a .jsp to disk. This is potentially indicative of a web shell being written to disk. +action.escu.eli5 = The following analytic identifies the process java writing a .jsp to disk. This is potentially indicative of a web shell being written to disk. Modify and tune the analytic based on data ingested. For instance, it may be worth running a broad query for jsp file writes first before performing a join. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. action.escu.known_false_positives = False positives are possible and filtering may be required. Restrict by assets or filter known jsp files that are common for the environment. -action.escu.creation_date = 2022-04-05 -action.escu.modification_date = 2022-04-05 +action.escu.creation_date = 2022-06-03 +action.escu.modification_date = 2022-06-03 action.escu.confidence = high action.escu.full_search_name = ESCU - Java Writing JSP File - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Spring4Shell CVE-2022-22965"] +action.escu.analytic_story = ["Spring4Shell CVE-2022-22965", "Atlassian Confluence Server and Data Center CVE-2022-26134"] action.risk = 1 action.risk.param._risk_message = An instance of $process_name$ was identified on endpoint $dest$ writing a jsp file to disk, potentially indicative of exploitation. action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -17197,11 +17197,11 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Java Writing JSP File - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spring4Shell CVE-2022-22965"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2022-22965"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Spring4Shell CVE-2022-22965", "Atlassian Confluence Server and Data Center CVE-2022-26134"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2022-22965"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = user,dest -action.notable.param.rule_description = The following analytic identifies the process java writing a .jsp to disk. This is potentially indicative of a web shell being written to disk. +action.notable.param.rule_description = The following analytic identifies the process java writing a .jsp to disk. This is potentially indicative of a web shell being written to disk. Modify and tune the analytic based on data ingested. For instance, it may be worth running a broad query for jsp file writes first before performing a join. action.notable.param.rule_title = Java Writing JSP File action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -18623,8 +18623,8 @@ action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic looks for suspicious commandline that modify the iptables firewall setting of a linux machine. This technique was seen in cyclopsblink malware where it modifies the firewall setting of the compromised machine to allow traffic to its tcp port that will be used to communicate with its C2 server. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. action.escu.known_false_positives = administrator may do this commandline for auditing and testing purposes. In this scenario filter is needed. -action.escu.creation_date = 2022-04-30 -action.escu.modification_date = 2022-04-30 +action.escu.creation_date = 2022-06-03 +action.escu.modification_date = 2022-06-03 action.escu.confidence = high action.escu.full_search_name = ESCU - Linux Iptables Firewall Modification - Rule action.escu.search_type = detection @@ -18652,7 +18652,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*iptables *" AND Processes.process = "* --dport *" AND Processes.process = "* ACCEPT*" AND Processes.process = "*&>/dev/null*" AND Processes.process = "* tcp *" AND NOT(Processes.parent_process_path IN("/bin/*", "/lib/*", "/usr/bin/*", "/sbin/*")) by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest Processes.user Processes.parent_process_name Processes.parent_process_path Processes.process_path | rex field=Processes.process "--dport (?3269|636|989|994|995|8443)" | stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) as guids values(Processes.process_id) as pids dc(port) as port_count count by Processes.process_name Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user Processes.parent_process_path Processes.process_path firstTime lastTime | where port_count >=3 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_iptables_firewall_modification_filter` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*iptables *" AND Processes.process = "* --dport *" AND Processes.process = "* ACCEPT*" AND Processes.process = "*&>/dev/null*" AND Processes.process = "* tcp *" AND NOT(Processes.parent_process_path IN("/bin/*", "/lib/*", "/usr/bin/*", "/sbin/*")) by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest _time span=10s Processes.user Processes.parent_process_name Processes.parent_process_path Processes.process_path | rex field=Processes.process "--dport (?3269|636|989|994|995|8443)" | stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) as guids values(Processes.process_id) as pids dc(port) as port_count count by Processes.process_name Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user Processes.parent_process_path Processes.process_path | where port_count >=3 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_iptables_firewall_modification_filter` [ESCU - Linux Java Spawning Shell - Rule] action.escu = 0 @@ -29470,9 +29470,9 @@ action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Ob action.escu.data_models = ["Endpoint"] action.escu.eli5 = Attackers often disable security tools to avoid detection. This search looks for the usage of process `fltMC.exe` to unload a Sysmon Driver that will stop sysmon from collecting the data. action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. This search is also shipped with `unload_sysmon_filter_driver_filter` macro, update this macro to filter out false positives. -action.escu.known_false_positives = -action.escu.creation_date = 2020-07-22 -action.escu.modification_date = 2020-07-22 +action.escu.known_false_positives = Unknown at the moment +action.escu.creation_date = 2022-06-01 +action.escu.modification_date = 2022-06-01 action.escu.confidence = high action.escu.full_search_name = ESCU - Unload Sysmon Filter Driver - Rule action.escu.search_type = detection @@ -30182,17 +30182,57 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="* -f *" OR Processes.process="* -b *") AND (Processes.process=*objectcategory* OR Processes.process="* -gcb *" OR Processes.process="* -sc *") by Processes.dest Processes.user Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_adfind_exe_filter` +[ESCU - Windows Command and Scripting Interpreter Hunting Path Traversal - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies path traversal command-line execution and should be used to tune and driver other more higher fidelity analytics. This technique was seen in malicious document that execute malicious code using msdt.exe and path traversal technique that serve as defense evasion. This Hunting query is a good pivot to look for possible suspicious process and command-line that runs execute path traversal technique to run malicious code. This may help you to find possible downloaded malware or other lolbin execution. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic identifies path traversal command-line execution and should be used to tune and driver other more higher fidelity analytics. This technique was seen in malicious document that execute malicious code using msdt.exe and path traversal technique that serve as defense evasion. This Hunting query is a good pivot to look for possible suspicious process and command-line that runs execute path traversal technique to run malicious code. This may help you to find possible downloaded malware or other lolbin execution. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product +action.escu.known_false_positives = false positive may vary depends on the score you want to check. The bigger number of path traversal string count the better. +action.escu.creation_date = 2022-06-01 +action.escu.modification_date = 2022-06-01 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Windows Command and Scripting Interpreter Hunting Path Traversal - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190"] +action.risk = 1 +action.risk.param._risk_message = A parent process $parent_process_name$ has spawned a child $process_name$ with path traversal commandline $process$ in $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Windows Command and Scripting Interpreter Hunting Path Traversal - Rule +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | eval count_of_pattern1 = (mvcount(split(process,"/.."))-1) | eval count_of_pattern2 = (mvcount(split(process,"\.."))-1) | eval count_of_pattern3 = (mvcount(split(process,"\\.."))-1) | eval count_of_pattern4 = (mvcount(split(process,"//.."))-1) | search count_of_pattern1 > 1 OR count_of_pattern2 > 1 OR count_of_pattern3 > 1 OR count_of_pattern4 > 1 | `windows_command_and_scripting_interpreter_hunting_path_traversal_filter` + [ESCU - Windows Command and Scripting Interpreter Path Traversal Exec - Rule] action.escu = 0 action.escu.enabled = 1 -description = The following analytic identifies path traversal commandline execution. This technique was seen in malicious document that execute malicious code using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and commandline that runs before and after this execution. This may help you to find possible downloaded malware or other lolbin execution. +description = The following analytic identifies path traversal command-line execution. This technique was seen in malicious document that execute malicious code using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and command-line that runs before and after this execution. This may help you to find possible downloaded malware or other lolbin execution. action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = The following analytic identifies path traversal commandline execution. This technique was seen in malicious document that execute malicious code using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and commandline that runs before and after this execution. This may help you to find possible downloaded malware or other lolbin execution. +action.escu.eli5 = The following analytic identifies path traversal command-line execution. This technique was seen in malicious document that execute malicious code using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and command-line that runs before and after this execution. This may help you to find possible downloaded malware or other lolbin execution. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product action.escu.known_false_positives = Not known at this moment. -action.escu.creation_date = 2022-05-30 -action.escu.modification_date = 2022-05-30 +action.escu.creation_date = 2022-06-01 +action.escu.modification_date = 2022-06-01 action.escu.confidence = high action.escu.full_search_name = ESCU - Windows Command and Scripting Interpreter Path Traversal Exec - Rule action.escu.search_type = detection @@ -30213,7 +30253,7 @@ action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evas schedule_window = auto action.notable = 1 action.notable.param.nes_fields = user,dest -action.notable.param.rule_description = The following analytic identifies path traversal commandline execution. This technique was seen in malicious document that execute malicious code using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and commandline that runs before and after this execution. This may help you to find possible downloaded malware or other lolbin execution. +action.notable.param.rule_description = The following analytic identifies path traversal command-line execution. This technique was seen in malicious document that execute malicious code using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and command-line that runs before and after this execution. This may help you to find possible downloaded malware or other lolbin execution. action.notable.param.rule_title = Windows Command and Scripting Interpreter Path Traversal Exec action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -30226,7 +30266,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*\/..\/..\/..\/..\/..\/..\/..\/..\/..\/*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_command_and_scripting_interpreter_path_traversal_exec_filter` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*\/..\/..\/..\/*" OR Processes.process="*\\..\\..\\..\\*" OR Processes.process="*\/\/..\/\/..\/\/..\/\/*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_command_and_scripting_interpreter_path_traversal_exec_filter` [ESCU - Windows Computer Account Created by Computer Account - Rule] action.escu = 0 @@ -31340,11 +31380,11 @@ search = `wineventlog_system` EventCode=7040 Message = "*service was changed fro action.escu = 0 action.escu.enabled = 1 description = The following analytic identifies a recently disclosed arbitraty command execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve a remote payload. During triage, review file modifications for html. Identify parallel process execution that may be related, including an Office Product. -action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1202"], "nist": ["DE.CM"]} +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218"], "nist": ["DE.CM"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies a recently disclosed arbitraty command execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve a remote payload. During triage, review file modifications for html. Identify parallel process execution that may be related, including an Office Product. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -action.escu.known_false_positives = False positives may be present, filter as needed. +action.escu.known_false_positives = False positives may be present, filter as needed. Added .xml to potentially capture any answer file usage. Remove as needed. action.escu.creation_date = 2022-05-30 action.escu.modification_date = 2022-05-30 action.escu.confidence = high @@ -31363,7 +31403,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Windows Execute Arbitrary Commands with MSDT - Rule -action.correlationsearch.annotations = {"analytic_story": ["Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2022-30190"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1202"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2022-30190"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = user,dest @@ -31380,7 +31420,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msdt.exe Processes.process="*ms-msdt:/id*" Processes.process="*IT_BrowseForFile=*" Processes.process="*IT_RebrowseForFile=*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_execute_arbitrary_commands_with_msdt_filter` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msdt.exe Processes.process IN ("*ms-msdt:/id*","*ms-msdt:-id*","*/id*") AND (Processes.process="*IT_BrowseForFile=*" OR Processes.process="*IT_RebrowseForFile=*" OR Processes.process="*.xml*") AND Processes.process="*PCWDiagnostic*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_execute_arbitrary_commands_with_msdt_filter` [ESCU - Windows File Without Extension In Critical Folder - Rule] action.escu = 0 @@ -39216,6 +39256,52 @@ realtime_schedule = 0 is_visible = false search = `stream_http` http_method=POST form_data IN ("*wermgr.exe*","*svchost.exe*", "*name=\"proclist\"*","*ipconfig*", "*name=\"sysinfo\"*", "*net view*") |stats values(form_data) as http_request_body min(_time) as firstTime max(_time) as lastTime count by http_method http_user_agent uri_path url bytes_in bytes_out | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `plain_http_post_exfiltrated_data_filter` +[ESCU - Confluence Unauthenticated Remote Code Execution CVE-2022-26134 - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic assists with identifying CVE-2022-26134 based exploitation utilizing the Web datamodel to cover network and CIM compliant web logs. The parameters were captured from live scanning and the POC provided by Rapid7. This analytic is written against multiple proof of concept codes released and seen in the wild (scanning). During triage, review any endpoint based logs for further activity including writing a jsp file to disk and commands/processes spawning running as root from the Confluence process. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1190"], "nist": ["DE.CM"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = The following analytic assists with identifying CVE-2022-26134 based exploitation utilizing the Web datamodel to cover network and CIM compliant web logs. The parameters were captured from live scanning and the POC provided by Rapid7. This analytic is written against multiple proof of concept codes released and seen in the wild (scanning). During triage, review any endpoint based logs for further activity including writing a jsp file to disk and commands/processes spawning running as root from the Confluence process. +action.escu.how_to_implement = This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache or Splunk for Nginx. In addition, network based logs or event data like PAN Threat. +action.escu.known_false_positives = Tune based on assets if possible, or restrict to known Confluence servers. Remove the ${ for a more broad query. To identify more exec, remove everything up to the last parameter (Runtime().exec) for a broad query. +action.escu.creation_date = 2022-06-03 +action.escu.modification_date = 2022-06-03 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Confluence Unauthenticated Remote Code Execution CVE-2022-26134 - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Atlassian Confluence Server and Data Center CVE-2022-26134"] +action.risk = 1 +action.risk.param._risk_message = A URL was requested related to CVE-2022-26134, a unauthenticated remote code execution vulnerability, on $dest$ by $src$. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 100}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 100}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Confluence Unauthenticated Remote Code Execution CVE-2022-26134 - Rule +action.correlationsearch.annotations = {"analytic_story": ["Atlassian Confluence Server and Data Center CVE-2022-26134"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Scope:Network"], "cve": ["CVE-2022-26134"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1190"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "IP Address"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = user,dest +action.notable.param.rule_description = The following analytic assists with identifying CVE-2022-26134 based exploitation utilizing the Web datamodel to cover network and CIM compliant web logs. The parameters were captured from live scanning and the POC provided by Rapid7. This analytic is written against multiple proof of concept codes released and seen in the wild (scanning). During triage, review any endpoint based logs for further activity including writing a jsp file to disk and commands/processes spawning running as root from the Confluence process. +action.notable.param.rule_title = Confluence Unauthenticated Remote Code Execution CVE-2022-26134 +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("*${*", "*%2F%7B*") (Web.url="*org.apache.commons.io.IOUtils*" Web.url="*java.lang.Runtime@getRuntime().exec*") OR (Web.url="*java.lang.Runtime%40getRuntime%28%29.exec*") OR (Web.url="*getEngineByName*" AND Web.url="*nashorn*" AND Web.url="*ProcessBuilder*") by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest sourcetype | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `confluence_unauthenticated_remote_code_execution_cve_2022_26134_filter` + [ESCU - Log4Shell JNDI Payload Injection Attempt - Rule] action.escu = 0 action.escu.enabled = 1 diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index 1043809aaa..ead268f0d4 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-05-31T17:59:08 UTC +# On Date: 2022-06-06T20:50:08 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/workflow_actions.conf b/dist/escu/default/workflow_actions.conf index ba37b52846..9ef141aaa8 100644 --- a/dist/escu/default/workflow_actions.conf +++ b/dist/escu/default/workflow_actions.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-05-31T17:59:08 UTC +# On Date: 2022-06-06T20:50:08 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/docs/_pages/detections.md b/docs/_pages/detections.md index bf76534087..e35b0f6062 100644 --- a/docs/_pages/detections.md +++ b/docs/_pages/detections.md @@ -108,6 +108,7 @@ sidebar: | [Cobalt Strike Named Pipes](/endpoint/cobalt_strike_named_pipes/) | [Process Injection](/tags/#process-injection) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Common Ransomware Extensions](/endpoint/common_ransomware_extensions/) | [Data Destruction](/tags/#data-destruction) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Common Ransomware Notes](/endpoint/common_ransomware_notes/) | [Data Destruction](/tags/#data-destruction) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Confluence Unauthenticated Remote Code Execution CVE-2022-26134](/web/confluence_unauthenticated_remote_code_execution_cve-2022-26134/) | [Server Software Component](/tags/#server-software-component), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Conti Common Exec parameter](/endpoint/conti_common_exec_parameter/) | [User Execution](/tags/#user-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Control Loading from World Writable Directory](/endpoint/control_loading_from_world_writable_directory/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Control Panel](/tags/#control-panel) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Correlation by Repository and Risk](/cloud/correlation_by_repository_and_risk/) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution) | [Correlation](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -805,6 +806,7 @@ sidebar: | [WinEvent Windows Task Scheduler Event Action Started](/endpoint/winevent_windows_task_scheduler_event_action_started/) | [Scheduled Task](/tags/#scheduled-task) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [WinRM Spawning a Process](/endpoint/winrm_spawning_a_process/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows AdFind Exe](/endpoint/windows_adfind_exe/) | [Remote System Discovery](/tags/#remote-system-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows Command and Scripting Interpreter Hunting Path Traversal](/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Command and Scripting Interpreter Path Traversal Exec](/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Computer Account Created by Computer Account](/endpoint/windows_computer_account_created_by_computer_account/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Computer Account Requesting Kerberos Ticket](/endpoint/windows_computer_account_requesting_kerberos_ticket/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | @@ -831,7 +833,7 @@ sidebar: | [Windows Event For Service Disabled](/endpoint/windows_event_for_service_disabled/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Event Log Cleared](/endpoint/windows_event_log_cleared/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Excessive Disabled Services Event](/endpoint/windows_excessive_disabled_services_event/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | -| [Windows Execute Arbitrary Commands with MSDT](/endpoint/windows_execute_arbitrary_commands_with_msdt/) | [Indirect Command Execution](/tags/#indirect-command-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Windows Execute Arbitrary Commands with MSDT](/endpoint/windows_execute_arbitrary_commands_with_msdt/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows File Without Extension In Critical Folder](/endpoint/windows_file_without_extension_in_critical_folder/) | [Data Destruction](/tags/#data-destruction) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Get-AdComputer Unconstrained Delegation Discovery](/endpoint/windows_get-adcomputer_unconstrained_delegation_discovery/) | [Remote System Discovery](/tags/#remote-system-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Windows Hidden Schedule Task Settings](/endpoint/windows_hidden_schedule_task_settings/) | [Scheduled Task/Job](/tags/#scheduled-task/job) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | diff --git a/docs/_pages/stories.md b/docs/_pages/stories.md index 50a247403a..9d241a8a92 100644 --- a/docs/_pages/stories.md +++ b/docs/_pages/stories.md @@ -24,6 +24,7 @@ sidebar: | [Active Directory Password Spraying](active_directory_password_spraying) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | [Credential Access](/tags/#credential-access) | | [Apache Struts Vulnerability](apache_struts_vulnerability) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) | | [Asset Tracking](asset_tracking) | None | None | +| [Atlassian Confluence Server and Data Center CVE-2022-26134](atlassian_confluence_server_and_data_center_cve-2022-26134) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Server Software Component](/tags/#server-software-component) | [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) | | [BITS Jobs](bits_jobs) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence) | | [Baron Samedit CVE-2021-3156](baron_samedit_cve-2021-3156) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) | | [BlackMatter Ransomware](blackmatter_ransomware) | [Credentials in Registry](/tags/#credentials-in-registry), [Unsecured Credentials](/tags/#unsecured-credentials), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Defacement](/tags/#defacement), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Credential Access](/tags/#credential-access), [Impact](/tags/#impact) | @@ -82,7 +83,7 @@ sidebar: | [Masquerading - Rename System Utilities](masquerading_-_rename_system_utilities) | [Rename System Utilities](/tags/#rename-system-utilities), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Masquerading](/tags/#masquerading), [Rundll32](/tags/#rundll32), [Data Destruction](/tags/#data-destruction), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [MSBuild](/tags/#msbuild), [InstallUtil](/tags/#installutil) | [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact) | | [Meterpreter](meterpreter) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Execution](/tags/#execution) | | [Microsoft MSHTML Remote Code Execution CVE-2021-40444](microsoft_mshtml_remote_code_execution_cve-2021-40444) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Control Panel](/tags/#control-panel), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access) | -| [Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190](microsoft_support_diagnostic_tool_vulnerability_cve-2022-30190) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Indirect Command Execution](/tags/#indirect-command-execution), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access) | +| [Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190](microsoft_support_diagnostic_tool_vulnerability_cve-2022-30190) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access) | | [Monitor Backup Solution](monitor_backup_solution) | None | None | | [Monitor for Unauthorized Software](monitor_for_unauthorized_software) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Masquerading](/tags/#masquerading), [OS Credential Dumping](/tags/#os-credential-dumping), [Active Scanning](/tags/#active-scanning) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Reconnaissance](/tags/#reconnaissance) | | [Monitor for Updates](monitor_for_updates) | None | None | diff --git a/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md b/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md index f51059115f..d284f074ec 100644 --- a/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md +++ b/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md @@ -106,8 +106,8 @@ The search is used to detect systems that are still vulnerable to the Spectre an #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **spectre_and_meltdown_vulnerable_systems_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md index 658c53560a..ec79fde91f 100644 --- a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md +++ b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md @@ -104,8 +104,8 @@ The search queries the authentication logs for assets that are categorized as ro #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_new_login_attempts_to_routers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md b/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md index 64449b47a3..d485eb70b4 100644 --- a/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md +++ b/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md @@ -99,8 +99,8 @@ This search returns a list of hosts that have not successfully completed a backu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **extended_period_without_successful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md b/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md index 14cc93f2cc..31a66e2bfa 100644 --- a/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md +++ b/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md @@ -98,8 +98,8 @@ This search gives you the hosts where a backup was attempted and then failed. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **unsuccessful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md index 1b3ac7265c..fe4ce2296c 100644 --- a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md +++ b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md @@ -106,8 +106,8 @@ This search looks for Windows endpoints that have not generated an event indicat #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **no_windows_updates_in_a_time_frame_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md index 6c4980927b..d522844132 100644 --- a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md +++ b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md @@ -103,8 +103,8 @@ Attackers often use spaces as a means to obfuscate an attachment's file extensio #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **email_attachments_with_lots_of_spaces_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md index 76b52316e2..410a212365 100644 --- a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md @@ -104,8 +104,8 @@ This search looks for specific GET or HEAD requests to web servers that are indi #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_attackers_scanning_for_vulnerable_jboss_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md index 375df95954..421516f284 100644 --- a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md @@ -109,8 +109,8 @@ This search is used to detect malicious HTTP requests crafted to exploit jmx-con #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_malicious_requests_to_exploit_jboss_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md index 9b35c63176..351df8d65f 100644 --- a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md @@ -95,9 +95,9 @@ This search looks for DNS requests for faux domains similar to the domains that #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [brand_abuse_dns](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_dns.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **monitor_dns_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md index f06b551e0c..e9ed6c984d 100644 --- a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md @@ -100,9 +100,9 @@ This search looks for Web requests to faux domains similar to the one that you w #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **monitor_web_traffic_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-11-27-detect_usb_device_insertion.md b/docs/_posts/2017-11-27-detect_usb_device_insertion.md index 6bcf6212ef..d728677662 100644 --- a/docs/_posts/2017-11-27-detect_usb_device_insertion.md +++ b/docs/_posts/2017-11-27-detect_usb_device_insertion.md @@ -100,8 +100,8 @@ The search is used to detect hosts that generate Windows Event ID 4663 for succe #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_usb_device_insertion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md index 155282e149..bfdf6ece90 100644 --- a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md +++ b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md @@ -105,8 +105,8 @@ This search looks for emails claiming to be sent from a domain similar to one th #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **monitor_email_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md b/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md index 7e2378e968..c5f5fd575e 100644 --- a/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md +++ b/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md @@ -122,8 +122,8 @@ This search will detect users creating spikes in API activity related to network #### Macros The SPL above uses the following Macros: -* [network_acl_events](https://github.com/splunk/security_content/blob/develop/macros/network_acl_events.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [network_acl_events](https://github.com/splunk/security_content/blob/develop/macros/network_acl_events.yml) > :information_source: > **detect_spike_in_network_acl_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md index 7ed3679870..638971b92a 100644 --- a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md +++ b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md @@ -110,8 +110,8 @@ This search looks for outbound ICMP packets with a packet size larger than 1,000 #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_large_outbound_icmp_packets_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md index f4a348e37c..473271fdc1 100644 --- a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md +++ b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md @@ -118,8 +118,8 @@ This search looks at S3 bucket-access logs and detects new or previously unseen #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [aws_s3_accesslogs](https://github.com/splunk/security_content/blob/develop/macros/aws_s3_accesslogs.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_s3_access_from_a_new_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-11-02-windows_hosts_file_modification.md b/docs/_posts/2018-11-02-windows_hosts_file_modification.md index 7af88de92d..a4d2ecf6d7 100644 --- a/docs/_posts/2018-11-02-windows_hosts_file_modification.md +++ b/docs/_posts/2018-11-02-windows_hosts_file_modification.md @@ -104,8 +104,8 @@ The search looks for modifications to the hosts file on all Windows endpoints ac #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_hosts_file_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md index 80916277f9..e330d0107c 100644 --- a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md +++ b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md @@ -111,8 +111,8 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote #### Macros The SPL above uses the following Macros: * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **remote_wmi_command_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-12-03-usn_journal_deletion.md b/docs/_posts/2018-12-03-usn_journal_deletion.md index 3c7e03fb3e..c7193842d3 100644 --- a/docs/_posts/2018-12-03-usn_journal_deletion.md +++ b/docs/_posts/2018-12-03-usn_journal_deletion.md @@ -113,8 +113,8 @@ The fsutil.exe application is a legitimate Windows utility used to perform tasks #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **usn_journal_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-12-06-suspicious_java_classes.md b/docs/_posts/2018-12-06-suspicious_java_classes.md index 6fa26f2d66..3e1d527e90 100644 --- a/docs/_posts/2018-12-06-suspicious_java_classes.md +++ b/docs/_posts/2018-12-06-suspicious_java_classes.md @@ -102,8 +102,8 @@ This search looks for suspicious Java classes that are often used to exploit rem #### Macros The SPL above uses the following Macros: -* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) > :information_source: > **suspicious_java_classes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-12-14-file_with_samsam_extension.md b/docs/_posts/2018-12-14-file_with_samsam_extension.md index 7fce34dd7a..92a288413c 100644 --- a/docs/_posts/2018-12-14-file_with_samsam_extension.md +++ b/docs/_posts/2018-12-14-file_with_samsam_extension.md @@ -101,8 +101,8 @@ The search looks for file writes with extensions consistent with a SamSam ransom #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **file_with_samsam_extension_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-12-14-samsam_test_file_write.md b/docs/_posts/2018-12-14-samsam_test_file_write.md index 99c865c735..57b1aa725c 100644 --- a/docs/_posts/2018-12-14-samsam_test_file_write.md +++ b/docs/_posts/2018-12-14-samsam_test_file_write.md @@ -107,8 +107,8 @@ The search looks for a file named "test.txt" written to the windows system direc #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **samsam_test_file_write_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md b/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md index 22f0bac396..48fbc32d63 100644 --- a/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md +++ b/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md @@ -107,8 +107,8 @@ The search looks for command-line arguments used to hide a file or directory usi #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **reg_exe_used_to_hide_files_directories_via_registry_keys_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md index da386816ec..36e29731e8 100644 --- a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md +++ b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md @@ -108,8 +108,8 @@ This search looks for suspicious processes on all systems labeled as web servers #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **web_servers_executing_suspicious_processes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-04-25-suspicious_file_write.md b/docs/_posts/2019-04-25-suspicious_file_write.md index 16d8353900..d7830d2ff0 100644 --- a/docs/_posts/2019-04-25-suspicious_file_write.md +++ b/docs/_posts/2019-04-25-suspicious_file_write.md @@ -100,8 +100,8 @@ The search looks for files created with names that have been linked to malicious #### Macros The SPL above uses the following Macros: * [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_file_write_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md index 68572ad175..903fc504cb 100644 --- a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md +++ b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md @@ -106,8 +106,8 @@ Command lines that are extremely long may be indicative of malicious activity on #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **unusually_long_command_line_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md index 438996c3f7..661feb67e5 100644 --- a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md +++ b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md @@ -102,8 +102,8 @@ This search looks for applications on the endpoint that you have marked as prohi #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [prohibited_softwares](https://github.com/splunk/security_content/blob/develop/macros/prohibited_softwares.yml) > :information_source: diff --git a/docs/_posts/2019-12-10-creation_of_shadow_copy.md b/docs/_posts/2019-12-10-creation_of_shadow_copy.md index 1da58c7e7f..08da7eedb3 100644 --- a/docs/_posts/2019-12-10-creation_of_shadow_copy.md +++ b/docs/_posts/2019-12-10-creation_of_shadow_copy.md @@ -112,8 +112,8 @@ Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy. #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **creation_of_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md index 0d2319e660..0634b112b0 100644 --- a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md +++ b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md @@ -123,8 +123,8 @@ This search allows you to identify DNS requests that are unusually large for the #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **dns_query_length_outliers_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md index 950d215c37..39452d1266 100644 --- a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md +++ b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md @@ -102,8 +102,8 @@ This search looks for processes referencing the plist files that determine which #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **macos_-_re-opened_applications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md index 9ca9610f1c..6a0338fdad 100644 --- a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md +++ b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md @@ -114,8 +114,8 @@ Detect the usage of comsvcs.dll for dumping the lsass process. #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **dump_lsass_via_comsvcs_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-03-02-remote_registry_key_modifications.md b/docs/_posts/2020-03-02-remote_registry_key_modifications.md index 31c7141664..9182f443c0 100644 --- a/docs/_posts/2020-03-02-remote_registry_key_modifications.md +++ b/docs/_posts/2020-03-02-remote_registry_key_modifications.md @@ -98,8 +98,8 @@ This search monitors for remote modifications to registry keys. #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **remote_registry_key_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md index b0acf6b1a0..33c18be258 100644 --- a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md +++ b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md @@ -116,8 +116,8 @@ This search looks for child processes of spoolsv.exe. This activity is associate #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **child_processes_of_spoolsv_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-03-16-detect_rare_executables.md b/docs/_posts/2020-03-16-detect_rare_executables.md index db880dad1e..49ce545359 100644 --- a/docs/_posts/2020-03-16-detect_rare_executables.md +++ b/docs/_posts/2020-03-16-detect_rare_executables.md @@ -113,8 +113,8 @@ This search will return a table of rare processes, the names of the systems runn #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml) > :information_source: diff --git a/docs/_posts/2020-03-16-process_execution_via_wmi.md b/docs/_posts/2020-03-16-process_execution_via_wmi.md index 8b0f895a95..ee4bab1330 100644 --- a/docs/_posts/2020-03-16-process_execution_via_wmi.md +++ b/docs/_posts/2020-03-16-process_execution_via_wmi.md @@ -110,8 +110,8 @@ The following analytic identifies `WmiPrvSE.exe` spawning a process. This typica #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **process_execution_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-03-16-script_execution_via_wmi.md b/docs/_posts/2020-03-16-script_execution_via_wmi.md index 8297eac46d..8cfa6e77a5 100644 --- a/docs/_posts/2020-03-16-script_execution_via_wmi.md +++ b/docs/_posts/2020-03-16-script_execution_via_wmi.md @@ -110,8 +110,8 @@ This search looks for scripts launched via WMI. #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **script_execution_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md index f8e8536bb0..1309557b22 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md @@ -103,8 +103,8 @@ This search provides information of unauthenticated requests via user agent, and #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **amazon_eks_kubernetes_cluster_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md index a963f0417f..881939da87 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md @@ -103,8 +103,8 @@ This search provides detection information on unauthenticated requests against K #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **amazon_eks_kubernetes_pod_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md index fb4a709347..3937632e2a 100644 --- a/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md +++ b/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md @@ -102,8 +102,8 @@ This search provides information of unauthenticated requests via user agent, and #### Macros The SPL above uses the following Macros: -* [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) > :information_source: > **gcp_kubernetes_cluster_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md index fca76e2e1c..e170e0f832 100644 --- a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md +++ b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md @@ -123,8 +123,8 @@ The detection Detect Path Interception By Creation Of program exe is detecting t #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_path_interception_by_creation_of_program_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-06-short_lived_windows_accounts.md b/docs/_posts/2020-07-06-short_lived_windows_accounts.md index 4e0025dae1..3412fb9342 100644 --- a/docs/_posts/2020-07-06-short_lived_windows_accounts.md +++ b/docs/_posts/2020-07-06-short_lived_windows_accounts.md @@ -114,8 +114,8 @@ This search detects accounts that were created and deleted in a short time perio #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **short_lived_windows_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-06-windows_event_log_cleared.md b/docs/_posts/2020-07-06-windows_event_log_cleared.md index e77d0c4535..610808a839 100644 --- a/docs/_posts/2020-07-06-windows_event_log_cleared.md +++ b/docs/_posts/2020-07-06-windows_event_log_cleared.md @@ -115,9 +115,9 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve #### Macros The SPL above uses the following Macros: +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **windows_event_log_cleared_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md index c45ef8426b..545796a26c 100644 --- a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md +++ b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md @@ -117,8 +117,8 @@ This search looks for network traffic on TCP/3389, the default port used by remo #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **remote_desktop_network_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md index 60cfe62adc..45e497632d 100644 --- a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md +++ b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md @@ -118,9 +118,9 @@ This search looks for attempts to stop security-related services on the endpoint #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **attempt_to_stop_security_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md index ca43b07f07..540303dc4e 100644 --- a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md +++ b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md @@ -123,14 +123,14 @@ This search looks for DNS requests for phishing domains that are leveraging Evil #### Macros The SPL above uses the following Macros: -* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml) -* [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml) * [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml) -* [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml) +* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml) +* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml) * [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml) * [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml) +* [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml) +* [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml) > :information_source: > **detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md index 6d646d59fc..e9fd64eac7 100644 --- a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md +++ b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md @@ -119,8 +119,8 @@ This search detects user accounts that have been locked out a relatively high nu #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_excessive_user_account_lockouts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md b/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md index 65843532d0..8a71757140 100644 --- a/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md +++ b/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md @@ -115,8 +115,8 @@ This search is used to detect attempts to use DNS tunneling, by calculating the #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_long_dns_txt_record_response_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md index 3deacfc3e0..0282f5b820 100644 --- a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md +++ b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md @@ -114,8 +114,8 @@ This search looks for outbound SMB connections made by hosts within your network #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_outbound_smb_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md index 7440974e9a..d8e12c392f 100644 --- a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md +++ b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md @@ -126,8 +126,8 @@ This search looks for execution of process `outlook.exe` where the process is wr #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_outlook_exe_writing_a_zip_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md index fe3c0f36fd..190ba0c31f 100644 --- a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md +++ b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md @@ -112,8 +112,8 @@ This search looks for the execution of the cscript.exe or wscript.exe processes, #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_use_of_cmd_exe_to_launch_script_interpreters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md index 6b95fea6a5..da4c4419a2 100644 --- a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md +++ b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md @@ -110,8 +110,8 @@ This search looks for web connections to dynamic DNS providers. #### Macros The SPL above uses the following Macros: * [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_web_traffic_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md index c83c255d84..79bd71b2c0 100644 --- a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md +++ b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md @@ -110,8 +110,8 @@ This search looks for specific command-line arguments that may indicate the exec #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detection_of_tools_built_by_nirsoft_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md index be6ba9b32f..a3f8704de8 100644 --- a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md +++ b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md @@ -118,9 +118,9 @@ This search looks for EC2 instances being modified by users who have not previou #### Macros The SPL above uses the following Macros: +* [ec2_modification_api_calls](https://github.com/splunk/security_content/blob/develop/macros/ec2_modification_api_calls.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -* [ec2_modification_api_calls](https://github.com/splunk/security_content/blob/develop/macros/ec2_modification_api_calls.yml) > :information_source: > **ec2_instance_modified_with_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md index ef311872d0..602677cc95 100644 --- a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md +++ b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md @@ -111,8 +111,8 @@ The search looks at the change-analysis data model and detects email files creat #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **email_files_written_outside_of_the_outlook_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md b/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md index c7a48b2c3f..29a348aab2 100644 --- a/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md +++ b/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md @@ -126,8 +126,8 @@ This search looks for command-line arguments that use a `/c` parameter to execut #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **first_time_seen_command_line_argument_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md index 97977c0cfd..3f454963e2 100644 --- a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md +++ b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md @@ -118,8 +118,8 @@ This search looks for the first and last time a Windows service is seen running #### Macros The SPL above uses the following Macros: -* [previously_seen_windows_services_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_windows_services_window.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [previously_seen_windows_services_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_windows_services_window.yml) > :information_source: > **first_time_seen_running_windows_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md index e846d6a5a6..9eca0f6f84 100644 --- a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md +++ b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md @@ -111,8 +111,8 @@ Attackers leverage an existing Windows binary, attrib.exe, to mark specific as h #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **hiding_files_and_directories_with_attrib_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md index b997bfa0c1..5f60fe9322 100644 --- a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md +++ b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md @@ -116,9 +116,9 @@ This search looks for PowerShell processes started with parameters used to bypas #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **malicious_powershell_process_-_execution_policy_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md index 553fd07f28..3d3a23142f 100644 --- a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md +++ b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md @@ -114,8 +114,8 @@ Microsoft Windows contains accessibility features that can be launched with a ke #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **overwriting_accessibility_binaries_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md index d8faab220c..631e7a941c 100644 --- a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md +++ b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md @@ -113,8 +113,8 @@ This search looks for network traffic defined by port and transport layer protoc #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **prohibited_network_traffic_allowed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md index dc8a715ac8..2a83d0b689 100644 --- a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md +++ b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md @@ -115,8 +115,8 @@ This search looks for network traffic on common ports where a higher layer proto #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **protocol_or_port_mismatch_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md index b7dc8e4a0e..80127df206 100644 --- a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md +++ b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md @@ -117,8 +117,8 @@ This search looks for the remote desktop process mstsc.exe running on systems up #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **remote_desktop_process_running_on_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md index 031cb96663..c77f07964f 100644 --- a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md +++ b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md @@ -119,8 +119,8 @@ This search looks for arguments to sc.exe indicating the creation or modificatio #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **sc_exe_manipulating_windows_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md b/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md index 4142da78fc..1e8576cece 100644 --- a/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md +++ b/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md @@ -109,8 +109,8 @@ This search looks for flags passed to schtasks.exe on the command-line that indi #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **scheduled_tasks_used_in_badrabbit_ransomware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md b/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md index 27a3f80476..ee8e48bbb9 100644 --- a/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md +++ b/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md @@ -113,8 +113,8 @@ This search looks for changes to registry values that control Windows file assoc #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_changes_to_file_associations_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md b/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md index 97b844b205..8610cdf3c4 100644 --- a/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md +++ b/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md @@ -107,8 +107,8 @@ This detection looks for emails that are suspicious because of their sender, dom #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_email_-_uba_anomaly_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md index 2004b3acf4..a9d2a15203 100644 --- a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md +++ b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md @@ -117,9 +117,9 @@ This search looks for emails that have attachments with suspicious file extensio #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [suspicious_email_attachments](https://github.com/splunk/security_content/blob/develop/macros/suspicious_email_attachments.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_email_attachment_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md index d7fa94ea7a..a04b2b45ac 100644 --- a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md +++ b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md @@ -114,8 +114,8 @@ This search looks for reg.exe being launched from a command prompt not started b #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_reg_exe_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-tor_traffic.md b/docs/_posts/2020-07-22-tor_traffic.md index 3dd7fb8db4..f6411060b4 100644 --- a/docs/_posts/2020-07-22-tor_traffic.md +++ b/docs/_posts/2020-07-22-tor_traffic.md @@ -114,8 +114,8 @@ This search looks for network traffic identified as The Onion Router (TOR), a be #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **tor_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md index 8bcf280cc2..11e77acc60 100644 --- a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md +++ b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md @@ -108,9 +108,9 @@ This search looks for applications on the endpoint that you have marked as uncom #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [uncommon_processes](https://github.com/splunk/security_content/blob/develop/macros/uncommon_processes.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **uncommon_processes_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md index ed73e8c274..906d51e1ca 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md @@ -117,8 +117,8 @@ This search detects SIGRed via Splunk Stream. #### Macros The SPL above uses the following Macros: -* [stream_dns](https://github.com/splunk/security_content/blob/develop/macros/stream_dns.yml) * [stream_tcp](https://github.com/splunk/security_content/blob/develop/macros/stream_tcp.yml) +* [stream_dns](https://github.com/splunk/security_content/blob/develop/macros/stream_dns.yml) > :information_source: > **detect_windows_dns_sigred_via_splunk_stream_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md index 17c0607e42..86f9ad6e66 100644 --- a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md +++ b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md @@ -122,8 +122,8 @@ This search looks for cloud instances being modified by users who have not previ #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **cloud_instance_modified_by_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md index 4877aed926..b18c0297cb 100644 --- a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md +++ b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md @@ -113,9 +113,9 @@ This search looks for the creation or deletion of hidden shares using net.exe. #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **create_or_delete_windows_shares_using_net_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md index a1331265ee..11f87c2188 100644 --- a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md +++ b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md @@ -117,8 +117,8 @@ Adversaries may abuse netbooting to load an unauthorized network device operatin #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_software_download_to_network_device_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-06-ryuk_test_files_detected.md b/docs/_posts/2020-11-06-ryuk_test_files_detected.md index d041187349..0d1c5cff53 100644 --- a/docs/_posts/2020-11-06-ryuk_test_files_detected.md +++ b/docs/_posts/2020-11-06-ryuk_test_files_detected.md @@ -106,8 +106,8 @@ The search looks for files that contain the key word *Ryuk* under any folder in #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **ryuk_test_files_detected_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md b/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md index b82ace11fb..aad62e03e2 100644 --- a/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md +++ b/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md @@ -106,8 +106,8 @@ The search looks for the Console Window Host process (connhost.exe) executed usi #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_connhost_exe_started_forcefully_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md index fbe87c02b9..455f8b1e96 100644 --- a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md +++ b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md @@ -106,8 +106,8 @@ The search looks for a Windows Security Account Manager (SAM) was stopped via co #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_security_account_manager_stopped_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-09-common_ransomware_extensions.md b/docs/_posts/2020-11-09-common_ransomware_extensions.md index 16f8f2ce59..dc37dca253 100644 --- a/docs/_posts/2020-11-09-common_ransomware_extensions.md +++ b/docs/_posts/2020-11-09-common_ransomware_extensions.md @@ -109,9 +109,9 @@ The search looks for file modifications with extensions commonly used by Ransomw #### Macros The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [ransomware_extensions](https://github.com/splunk/security_content/blob/develop/macros/ransomware_extensions.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **common_ransomware_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-09-common_ransomware_notes.md b/docs/_posts/2020-11-09-common_ransomware_notes.md index fcae1b501f..315432c79b 100644 --- a/docs/_posts/2020-11-09-common_ransomware_notes.md +++ b/docs/_posts/2020-11-09-common_ransomware_notes.md @@ -108,9 +108,9 @@ The search looks for files created with names matching those typically used in r #### Macros The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [ransomware_notes](https://github.com/splunk/security_content/blob/develop/macros/ransomware_notes.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **common_ransomware_notes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-09-deleting_shadow_copies.md b/docs/_posts/2020-11-09-deleting_shadow_copies.md index 5220a7a914..f6b57fe6ab 100644 --- a/docs/_posts/2020-11-09-deleting_shadow_copies.md +++ b/docs/_posts/2020-11-09-deleting_shadow_copies.md @@ -109,8 +109,8 @@ The vssadmin.exe utility is used to interact with the Volume Shadow Copy Service #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **deleting_shadow_copies_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md index a66f50336a..2deda244e4 100644 --- a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md +++ b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md @@ -119,8 +119,8 @@ This search identifies endpoints that have caused a relatively high number of ac #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_excessive_account_lockouts_from_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md index 5bfea4bfef..f3728f515c 100644 --- a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md +++ b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md @@ -113,9 +113,9 @@ This search looks for fast execution of processes used for system network config #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [system_network_configuration_discovery_tools](https://github.com/splunk/security_content/blob/develop/macros/system_network_configuration_discovery_tools.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_processes_used_for_system_network_configuration_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md index 1653748824..d2ce551ed0 100644 --- a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md +++ b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md @@ -113,10 +113,10 @@ This search looks for executions of cmd.exe spawned by a process that is often a #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_prohibited_applications_spawning_cmd_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md index a635804329..83b2b703c9 100644 --- a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md +++ b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md @@ -114,8 +114,8 @@ This search looks for processes launched from files that have double extensions #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **execution_of_file_with_multiple_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md b/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md index 55390d3e19..5850ce8104 100644 --- a/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md +++ b/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md @@ -109,8 +109,8 @@ This search looks for processes launched from files with at least five spaces in #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **execution_of_file_with_spaces_before_extension_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-23-processes_created_by_netsh.md b/docs/_posts/2020-11-23-processes_created_by_netsh.md index 4f822f395c..7b7f79645c 100644 --- a/docs/_posts/2020-11-23-processes_created_by_netsh.md +++ b/docs/_posts/2020-11-23-processes_created_by_netsh.md @@ -107,8 +107,8 @@ This search looks for processes launching netsh.exe to execute various commands #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **processes_created_by_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md index 4b7da73120..e2c9aaaf5c 100644 --- a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md +++ b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md @@ -113,8 +113,8 @@ This search detects the process execution and arguments required to silently cre #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **shim_database_installation_with_suspicious_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md index 3ae13aaa91..14d83a388f 100644 --- a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md +++ b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md @@ -121,8 +121,8 @@ The search looks for reg.exe modifying registry keys that define Windows service #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **reg_exe_manipulating_windows_services_registry_keys_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md index a491d093cf..bf5a4d23b9 100644 --- a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md +++ b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md @@ -115,8 +115,8 @@ This search looks for flags passed to schtasks.exe on the command-line that indi #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **schtasks_used_for_forcing_a_reboot_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-08-shim_database_file_creation.md b/docs/_posts/2020-12-08-shim_database_file_creation.md index 3c3b4afebb..0ce6a8a469 100644 --- a/docs/_posts/2020-12-08-shim_database_file_creation.md +++ b/docs/_posts/2020-12-08-shim_database_file_creation.md @@ -112,8 +112,8 @@ This search looks for shim database files being written to default directories. #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **shim_database_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md index 1f18944d0c..545bc9c5ad 100644 --- a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md +++ b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md @@ -115,8 +115,8 @@ This search looks for process names that consist only of a single letter. #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **single_letter_process_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md index e6918240a1..617e428b64 100644 --- a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md +++ b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md @@ -115,9 +115,9 @@ During triage, review the parallel processes - what process moved the native Win #### Macros The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [is_windows_system_file](https://github.com/splunk/security_content/blob/develop/macros/is_windows_system_file.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **system_processes_run_from_unexpected_locations_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-08-unusually_long_command_line.md b/docs/_posts/2020-12-08-unusually_long_command_line.md index 4bca43b17b..a6874e39d2 100644 --- a/docs/_posts/2020-12-08-unusually_long_command_line.md +++ b/docs/_posts/2020-12-08-unusually_long_command_line.md @@ -105,8 +105,8 @@ Command lines that are extremely long may be indicative of malicious activity on #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **unusually_long_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md index cbaa2a7114..9a0522dffa 100644 --- a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md +++ b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md @@ -106,8 +106,8 @@ This search looks for flags passed to bcdedit.exe modifications to the built-in #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **bcdedit_failure_recovery_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md index c83bf0da91..56ad8afeab 100644 --- a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md +++ b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md @@ -107,9 +107,9 @@ The following analytic identifies microsoft.workflow.compiler.exe usage. microso #### Macros The SPL above uses the following Macros: -* [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml) > :information_source: > **suspicious_microsoft_workflow_compiler_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md index be49ceb327..2981f697b7 100644 --- a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md +++ b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md @@ -112,9 +112,9 @@ The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavi #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_msbuild_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md index 62ab0f3d32..f837ac19d1 100644 --- a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md +++ b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md @@ -112,8 +112,8 @@ The following analytic identifies child processes spawning from "mshta.exe". Th #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_mshta_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md index 625ce535e6..f3ff99120f 100644 --- a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md +++ b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md @@ -112,9 +112,9 @@ Malicious actors often abuse legitimate Dynamic DNS services to host malicious p #### Macros The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [dynamic_dns_providers](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_providers.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_hosts_connecting_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md index c5775eb74a..c82dde054d 100644 --- a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md +++ b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md @@ -118,9 +118,9 @@ This search looks for PowerShell processes launched with arguments that have cha #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **malicious_powershell_process_with_obfuscation_techniques_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md b/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md index da3b0bca32..f48bcf3d8c 100644 --- a/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md +++ b/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md @@ -112,8 +112,8 @@ This search looks for PowerShell processes started with a base64 encoded command #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_powershell_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md index 6099e8c675..9dd8f0fe7a 100644 --- a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md +++ b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md @@ -113,8 +113,8 @@ The following analytic identifies "rundll32.exe" execution with inline protocol #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_rundll32_inline_hta_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md index 8c9e4e8eab..c1aa23acd7 100644 --- a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md +++ b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md @@ -112,9 +112,9 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_mshta_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md index adb6f92ec6..1a8acc8dc0 100644 --- a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md +++ b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md @@ -106,8 +106,8 @@ This search looks for flags passed to wbadmin.exe (Windows Backup Administrator #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **wbadmin_delete_system_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md b/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md index ec35fb3d93..86e33ba13c 100644 --- a/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md +++ b/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md @@ -93,8 +93,8 @@ This search looks for arguments to certutil.exe indicating the manipulation or e #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **certutil_exe_certificate_extraction_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md index af6f444458..bf8e91a006 100644 --- a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md +++ b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md @@ -114,8 +114,8 @@ Upon investigating, look for network connections to remote destinations (interna #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_regsvr32_application_control_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md index dda50e0817..c02bb291a8 100644 --- a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md +++ b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md @@ -114,8 +114,8 @@ This technique uses "Install from Media" (IFM), which will extract a copy of the #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **ntdsutil_export_ntds_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md index ec20753b29..67902820ae 100644 --- a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md +++ b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md @@ -113,8 +113,8 @@ Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_regsvr32_register_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md index 75dc50ffee..5a903ef10e 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md @@ -113,8 +113,8 @@ The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_rundll32_application_control_bypass_-_advpack_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md index 3e6588b4f0..e305c8b68c 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md @@ -113,8 +113,8 @@ The following analytic identifies rundll32.exe loading setupapi.dll and iesetupa #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_rundll32_application_control_bypass_-_setupapi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md index 742b5c98c6..d8c9000127 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md @@ -113,8 +113,8 @@ The following analytic identifies rundll32.exe loading syssetup.dll by calling t #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_rundll32_application_control_bypass_-_syssetup_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md index 9381724d97..63ee241b2a 100644 --- a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md +++ b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md @@ -113,8 +113,8 @@ The following analytic identifies rundll32.exe executing a DLL function name, St #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_rundll32_startw_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md index 292a669702..bc208c5e86 100644 --- a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md +++ b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md @@ -113,8 +113,8 @@ The following analytic identifies rundll32.exe using dllregisterserver on the co #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_rundll32_dllregisterserver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md index c0b4bc7a67..3b86e6e0d0 100644 --- a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md +++ b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md @@ -112,8 +112,8 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_html_help_spawn_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md index cd7ca3972f..f85e76b088 100644 --- a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md +++ b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md @@ -112,8 +112,8 @@ The following analytic identifies regasm.exe spawning a process. This particular #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_regasm_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md index 762ef51bb9..078a873546 100644 --- a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md +++ b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md @@ -112,8 +112,8 @@ The following analytic identifies regsvcs.exe spawning a process. This particula #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_regsvcs_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md index 30f9a2acf5..e25de67624 100644 --- a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md +++ b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md @@ -104,8 +104,8 @@ The following analytic identifies the use of a curl contacting suspicious remote #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_curl_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md index 428f6b8d56..5e9fb637c6 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md @@ -118,8 +118,8 @@ Upon triage, capture the property list file being written to disk and review for #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_plistbuddy_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md index b245612546..2fcfb82b2f 100644 --- a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md +++ b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md @@ -104,8 +104,8 @@ The following analytic identifies the use of a SQLite3 querying the MacOS prefer #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_sqlite3_lsquarantine_behavior_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md index 88aedeb6ce..4fca2c5b1d 100644 --- a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md +++ b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md @@ -118,8 +118,8 @@ Upon triage, fodhelper.exe will have a child process and read access will occur #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **fodhelper_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md index 607c8d3cf4..9050ba0148 100644 --- a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md +++ b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md @@ -107,8 +107,8 @@ This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware. #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **ryuk_wake_on_lan_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md index f036563722..0a2f0ff5d4 100644 --- a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md +++ b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md @@ -111,8 +111,8 @@ The following detection identifies Scheduled Tasks registering (creating a new t #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_scheduled_task_from_public_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md index ac24cff45e..b68b16519d 100644 --- a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md +++ b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md @@ -107,8 +107,8 @@ This detection identifies Microsoft Exchange Server's Unified Messaging services #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **unified_messaging_service_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md index 171845712b..f86c4ee224 100644 --- a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md +++ b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md @@ -112,8 +112,8 @@ The search looks for the Registry Key DisableAntiSpyware set to disable. This is #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_disableantispyware_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md index ca2f4ac480..130f7c6dcd 100644 --- a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md +++ b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md @@ -107,9 +107,9 @@ This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **nishang_powershelltcponeline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-03-w3wp_spawning_shell.md b/docs/_posts/2021-03-03-w3wp_spawning_shell.md index d92ee514cf..3eca1c53ab 100644 --- a/docs/_posts/2021-03-03-w3wp_spawning_shell.md +++ b/docs/_posts/2021-03-03-w3wp_spawning_shell.md @@ -116,10 +116,10 @@ This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **w3wp_spawning_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md index 8c9f90e057..d06ace054c 100644 --- a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md +++ b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md @@ -102,8 +102,8 @@ The following analytics identifies the resizing of shadowstorage by ransomware m #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **resize_shadowstorage_volume_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-17-clop_common_exec_parameter.md b/docs/_posts/2021-03-17-clop_common_exec_parameter.md index a5a8ca1fac..071a22bdd3 100644 --- a/docs/_posts/2021-03-17-clop_common_exec_parameter.md +++ b/docs/_posts/2021-03-17-clop_common_exec_parameter.md @@ -102,8 +102,8 @@ The following analytics are designed to identifies some CLOP ransomware variant #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **clop_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md index 20649a78c8..0b7fdfe081 100644 --- a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md +++ b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md @@ -102,8 +102,8 @@ This detection is to identify the common service name created by the CLOP ransom #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **clop_ransomware_known_service_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-23-certutil_with_decode_argument.md b/docs/_posts/2021-03-23-certutil_with_decode_argument.md index 4e2db07e22..af163128da 100644 --- a/docs/_posts/2021-03-23-certutil_with_decode_argument.md +++ b/docs/_posts/2021-03-23-certutil_with_decode_argument.md @@ -102,9 +102,9 @@ CertUtil.exe may be used to `encode` and `decode` a file, including PE and scrip #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **certutil_with_decode_argument_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md index e540c62069..69da9eb447 100644 --- a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md +++ b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md @@ -103,9 +103,9 @@ Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functio #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **powershell_start-bitstransfer_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md index 01095298e1..f0359f53c9 100644 --- a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md +++ b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md @@ -108,8 +108,8 @@ This search is to identifies suspicious firewall disabling using netsh applicati #### Macros The SPL above uses the following Macros: * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **disabling_firewall_with_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-31-dsquery_domain_discovery.md b/docs/_posts/2021-03-31-dsquery_domain_discovery.md index 5da293842c..5d78235363 100644 --- a/docs/_posts/2021-03-31-dsquery_domain_discovery.md +++ b/docs/_posts/2021-03-31-dsquery_domain_discovery.md @@ -107,8 +107,8 @@ In addition to trust discovery, review parallel processes for additional behavio #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **dsquery_domain_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md index ebd16db17c..ab261f4d7d 100644 --- a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md +++ b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md @@ -115,8 +115,8 @@ This detection is to identify the abuse the Windows SC.exe to execute malicious #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **malicious_powershell_executed_as_a_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-12-excel_spawning_powershell.md b/docs/_posts/2021-04-12-excel_spawning_powershell.md index 827d3d903e..20d0073cd2 100644 --- a/docs/_posts/2021-04-12-excel_spawning_powershell.md +++ b/docs/_posts/2021-04-12-excel_spawning_powershell.md @@ -107,9 +107,9 @@ The following detection identifies Microsoft Excel spawning PowerShell. Typicall #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **excel_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md index 97711642bd..881449035a 100644 --- a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md +++ b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md @@ -107,8 +107,8 @@ The following detection identifies Microsoft Excel spawning Windows Script Host #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **excel_spawning_windows_script_host_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-12-winword_spawning_powershell.md b/docs/_posts/2021-04-12-winword_spawning_powershell.md index 182f4dafbf..501c9660d5 100644 --- a/docs/_posts/2021-04-12-winword_spawning_powershell.md +++ b/docs/_posts/2021-04-12-winword_spawning_powershell.md @@ -107,9 +107,9 @@ The following detection identifies Microsoft Word spawning PowerShell. Typically #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **winword_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md index fb285a2aab..e7b23e671b 100644 --- a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md +++ b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md @@ -107,8 +107,8 @@ The following detection identifies Microsoft Winword.exe spawning Windows Script #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **winword_spawning_windows_script_host_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md index 255a986595..75a6897250 100644 --- a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md +++ b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md @@ -108,8 +108,8 @@ this detection was designed to identifies suspicious spawned process of known MS #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **office_application_spawn_rundll32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md index cabd59cc6b..b318ba8cc3 100644 --- a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md +++ b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md @@ -102,8 +102,8 @@ this search is to detect potential DNS exfiltration using nslookup application. #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **dns_exfiltration_using_nslookup_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md index 6af6b73b14..4cdbd433e0 100644 --- a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md +++ b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md @@ -102,10 +102,10 @@ This search is designed to detect suspicious cmd and powershell process spawned #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **wermgr_process_spawned_cmd_or_powershell_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md index ec93fceb92..f787b8f414 100644 --- a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md +++ b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md @@ -109,8 +109,8 @@ This search is designed to detect high frequency of archive files data exfiltrat #### Macros The SPL above uses the following Macros: -* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) > :information_source: > **multiple_archive_files_http_post_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md index 730593c05b..7d58b841d5 100644 --- a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md +++ b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md @@ -107,8 +107,8 @@ The following detection identifies a 7z.exe spawned from `Rundll32.exe` or `Dllh #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **anomalous_usage_of_7zip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md index a78bcf13c0..e0ae691ef6 100644 --- a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md +++ b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md @@ -108,8 +108,8 @@ The following detection identifies the latest behavior utilized by IcedID malwar #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **office_product_spawning_rundll32_with_no_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md index 8b9810d35a..2f4662d6e8 100644 --- a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md +++ b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md @@ -106,8 +106,8 @@ This search is to detect potential plain HTTP POST method data exfiltration. Thi #### Macros The SPL above uses the following Macros: -* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) > :information_source: > **plain_http_post_exfiltrated_data_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-22-winword_spawning_cmd.md b/docs/_posts/2021-04-22-winword_spawning_cmd.md index eb76a29dcb..cd8bc91dff 100644 --- a/docs/_posts/2021-04-22-winword_spawning_cmd.md +++ b/docs/_posts/2021-04-22-winword_spawning_cmd.md @@ -107,9 +107,9 @@ The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **winword_spawning_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md index aff2d794c5..1678be0cca 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md +++ b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md @@ -107,9 +107,9 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **office_product_spawning_bitsadmin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-26-office_product_spawning_certutil.md b/docs/_posts/2021-04-26-office_product_spawning_certutil.md index f488fe6b17..68372ed7a1 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_certutil.md +++ b/docs/_posts/2021-04-26-office_product_spawning_certutil.md @@ -107,9 +107,9 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **office_product_spawning_certutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-26-office_product_spawning_mshta.md b/docs/_posts/2021-04-26-office_product_spawning_mshta.md index 928f33d95d..5fda55ea06 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_mshta.md +++ b/docs/_posts/2021-04-26-office_product_spawning_mshta.md @@ -107,9 +107,9 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **office_product_spawning_mshta_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-29-icacls_deny_command.md b/docs/_posts/2021-04-29-icacls_deny_command.md index 0564a725e3..4eae75a7fe 100644 --- a/docs/_posts/2021-04-29-icacls_deny_command.md +++ b/docs/_posts/2021-04-29-icacls_deny_command.md @@ -102,8 +102,8 @@ This analytic identifies a potential adversary that changes the security permiss #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **icacls_deny_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-deleting_of_net_users.md b/docs/_posts/2021-05-04-deleting_of_net_users.md index 0c14ba885d..cb96058580 100644 --- a/docs/_posts/2021-05-04-deleting_of_net_users.md +++ b/docs/_posts/2021-05-04-deleting_of_net_users.md @@ -102,9 +102,9 @@ This analytic will detect a suspicious net.exe/net1.exe command-line to delete a #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **deleting_of_net_users_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-disabling_net_user_account.md b/docs/_posts/2021-05-04-disabling_net_user_account.md index 527779eb86..e183e6433d 100644 --- a/docs/_posts/2021-05-04-disabling_net_user_account.md +++ b/docs/_posts/2021-05-04-disabling_net_user_account.md @@ -102,9 +102,9 @@ This analytic will identify a suspicious command-line that disables a user accou #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **disabling_net_user_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md index a0299d74cd..b09ec6c2e0 100644 --- a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md +++ b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md @@ -103,8 +103,8 @@ This analytic will identify suspicious series of command-line to disable several #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **excessive_attempt_to_disable_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md index dd85acd186..d04c52af26 100644 --- a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md +++ b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md @@ -103,9 +103,9 @@ This analytic identifies suspicious series of attempt to kill multiple services #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **excessive_service_stop_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md index 6f39ebd87d..58d25495b2 100644 --- a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md +++ b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md @@ -108,8 +108,8 @@ This analytic identifies excessive usage of `taskkill.exe` application. This app #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **excessive_usage_of_taskkill_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-icacls_grant_command.md b/docs/_posts/2021-05-04-icacls_grant_command.md index eb7ba0395c..01c62fcfba 100644 --- a/docs/_posts/2021-05-04-icacls_grant_command.md +++ b/docs/_posts/2021-05-04-icacls_grant_command.md @@ -102,8 +102,8 @@ This analytic identifies potential adversaries that modify the security permissi #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **icacls_grant_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md index 2c38baa934..2991a72568 100644 --- a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md +++ b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md @@ -108,8 +108,8 @@ The following analytic identifies the use of `wmic.exe` using `delete` to remove #### Macros The SPL above uses the following Macros: * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **process_kill_base_on_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-05-suspicious_process_file_path.md b/docs/_posts/2021-05-05-suspicious_process_file_path.md index 20defc4a27..aea34adffa 100644 --- a/docs/_posts/2021-05-05-suspicious_process_file_path.md +++ b/docs/_posts/2021-05-05-suspicious_process_file_path.md @@ -103,8 +103,8 @@ The following analytic will detect a suspicious process running in a file path w #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_process_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md index bc21e21b96..5024c92f03 100644 --- a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md +++ b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md @@ -103,9 +103,9 @@ This analytic identifies excessive usage of `net.exe` or `net1.exe` within a buc #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **excessive_usage_of_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md index f92d154dec..349ae29be9 100644 --- a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md +++ b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md @@ -102,8 +102,8 @@ This analytic will identify suspicious executable or scripts (known file extensi #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **executables_or_script_creation_in_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md index 90fde55d8b..7a6bc74726 100644 --- a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md +++ b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md @@ -103,8 +103,8 @@ The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe` o #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **excessive_usage_of_cacls_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md index d63ea1659d..9e8d148a76 100644 --- a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md +++ b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md @@ -104,8 +104,8 @@ This analytic identifies an on demand run of a Windows Schedule Task through she #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **schtasks_run_task_on_demand_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md b/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md index b1bcc55565..cdb6bd5506 100644 --- a/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md +++ b/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md @@ -101,8 +101,8 @@ This following analytic detects PowerShell command to delete shadow copy using t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **delete_shadowcopy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-13-slui_runas_elevated.md b/docs/_posts/2021-05-13-slui_runas_elevated.md index a1835dbf5b..6f128776c8 100644 --- a/docs/_posts/2021-05-13-slui_runas_elevated.md +++ b/docs/_posts/2021-05-13-slui_runas_elevated.md @@ -109,8 +109,8 @@ The following analytic identifies the Microsoft Software Licensing User Interfac #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **slui_runas_elevated_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-13-slui_spawning_a_process.md b/docs/_posts/2021-05-13-slui_spawning_a_process.md index 34b893e943..ec237144a1 100644 --- a/docs/_posts/2021-05-13-slui_spawning_a_process.md +++ b/docs/_posts/2021-05-13-slui_spawning_a_process.md @@ -109,8 +109,8 @@ The following analytic identifies the Microsoft Software Licensing User Interfac #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **slui_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-18-services_escalate_exe.md b/docs/_posts/2021-05-18-services_escalate_exe.md index f6b26aed3e..47924bf50c 100644 --- a/docs/_posts/2021-05-18-services_escalate_exe.md +++ b/docs/_posts/2021-05-18-services_escalate_exe.md @@ -103,8 +103,8 @@ The following analytic identifies the use of `svc-exe` with Cobalt Strike. The b #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **services_escalate_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md b/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md index 9f0639ec6f..f8d18f858e 100644 --- a/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md +++ b/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md @@ -106,8 +106,8 @@ The following analytic identifies suspicious PowerShell command to allow inbound #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **allow_inbound_traffic_in_firewall_rule_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-19-mailsniper_invoke_functions.md b/docs/_posts/2021-05-19-mailsniper_invoke_functions.md index 4ea231a206..e5e1267fc9 100644 --- a/docs/_posts/2021-05-19-mailsniper_invoke_functions.md +++ b/docs/_posts/2021-05-19-mailsniper_invoke_functions.md @@ -106,8 +106,8 @@ This search is to detect known mailsniper.ps1 functions executed in a machine. T #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **mailsniper_invoke_functions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md index 38b96a46ec..c32f863108 100644 --- a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md +++ b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md @@ -119,9 +119,9 @@ This analytic identifies a common behavior by Cobalt Strike and other frameworks #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **cmd_echo_pipe_-_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-21-winrm_spawning_a_process.md b/docs/_posts/2021-05-21-winrm_spawning_a_process.md index 2f887bf9b1..f941292f1b 100644 --- a/docs/_posts/2021-05-21-winrm_spawning_a_process.md +++ b/docs/_posts/2021-05-21-winrm_spawning_a_process.md @@ -110,8 +110,8 @@ The following analytic identifies suspicious processes spawning from WinRM (wsmp #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **winrm_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md index a21d072f69..42ee811fe0 100644 --- a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md +++ b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md @@ -107,8 +107,8 @@ This analytic detects a potential usage of secretsdump.py tool for dumping crede #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **secretdumps_offline_ntds_dumping_tool_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md index 41ab2d83b9..f6da8244e1 100644 --- a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md +++ b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md @@ -132,8 +132,8 @@ SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. Shar #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_sharphound_file_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-27-detect_sharphound_usage.md b/docs/_posts/2021-05-27-detect_sharphound_usage.md index 152ca345eb..3fe7723c86 100644 --- a/docs/_posts/2021-05-27-detect_sharphound_usage.md +++ b/docs/_posts/2021-05-27-detect_sharphound_usage.md @@ -132,8 +132,8 @@ The following analytic identifies SharpHound binary usage by using the original #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_sharphound_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md index ff48516595..93e1e6b5cc 100644 --- a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md +++ b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md @@ -132,8 +132,8 @@ The following analytic identifies the common command-line argument used by Azure #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_azurehound_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md index 4b312b53f1..b9c6d7610e 100644 --- a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md +++ b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md @@ -132,8 +132,8 @@ The following analytic is similar to SharpHound file modifications, but this ins #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_azurehound_file_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md index 5b0437505b..efc68eb9c4 100644 --- a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md +++ b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md @@ -132,8 +132,8 @@ The following analytic identifies common command-line arguments used by SharpHou #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_sharphound_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-02-conti_common_exec_parameter.md b/docs/_posts/2021-06-02-conti_common_exec_parameter.md index 9167d33ce5..316ee41a9b 100644 --- a/docs/_posts/2021-06-02-conti_common_exec_parameter.md +++ b/docs/_posts/2021-06-02-conti_common_exec_parameter.md @@ -102,8 +102,8 @@ This search detects the suspicious commandline argument of revil ransomware to e #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **conti_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-02-revil_common_exec_parameter.md b/docs/_posts/2021-06-02-revil_common_exec_parameter.md index 3a23505f10..333cfb289a 100644 --- a/docs/_posts/2021-06-02-revil_common_exec_parameter.md +++ b/docs/_posts/2021-06-02-revil_common_exec_parameter.md @@ -102,8 +102,8 @@ This analytic identifies suspicious commandline parameter that are commonly used #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **revil_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md index e87879902a..3c01acc3b9 100644 --- a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md +++ b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md @@ -101,8 +101,8 @@ This search detects a suspicioous termination of known services killed by ransom #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **known_services_killed_by_ransomware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md index 78a645abb8..21bfada3a3 100644 --- a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md +++ b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md @@ -107,8 +107,8 @@ This detection targets behaviors observed in post exploit kits like Meterpreter #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **excessive_number_of_taskhost_processes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md b/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md index 9ee956342a..98ba72fb42 100644 --- a/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md +++ b/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md @@ -114,8 +114,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_fileless_process_injection_via_getprocaddress_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md b/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md index 0dd71e0692..c538fe2b26 100644 --- a/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md +++ b/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md @@ -113,8 +113,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_fileless_script_contains_base64_encoded_content_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md b/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md index 937137c5c5..fa15056f8b 100644 --- a/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md +++ b/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md @@ -107,8 +107,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_empire_with_powershell_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md b/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md index 9cdd30b4b4..b7dc1c284f 100644 --- a/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md +++ b/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md @@ -102,8 +102,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_mimikatz_with_powershell_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md index 6951933b36..793f8550d3 100644 --- a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md +++ b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md @@ -112,8 +112,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **unloading_amsi_via_reflection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md index 6961249843..262e1b6bf6 100644 --- a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md +++ b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md @@ -107,8 +107,8 @@ this search is to detect execution of `cipher.exe` to clear the unallocated sect #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **clear_unallocated_sector_using_cipher_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md index 0a14d81719..0ea696d65d 100644 --- a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md +++ b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md @@ -107,8 +107,8 @@ This search is to detect execution of wevtutil.exe to disable logs. This techniq #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **disable_logs_using_wevtutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md index 5c7f7d0575..d895f70a46 100644 --- a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md +++ b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md @@ -102,8 +102,8 @@ This search is to detect a modification of file or directory permission using ta #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **permission_modification_using_takeown_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md b/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md index 3d95cf36ad..6c6cf0c524 100644 --- a/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md +++ b/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md @@ -105,8 +105,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_creating_thread_mutex_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-powershell_domain_enumeration.md b/docs/_posts/2021-06-10-powershell_domain_enumeration.md index 0757c652df..ddf93250e3 100644 --- a/docs/_posts/2021-06-10-powershell_domain_enumeration.md +++ b/docs/_posts/2021-06-10-powershell_domain_enumeration.md @@ -107,8 +107,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_domain_enumeration_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md b/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md index 667a553d34..22736ee8b4 100644 --- a/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md +++ b/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md @@ -107,8 +107,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_loading_dotnet_into_memory_via_reflection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md b/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md index b71eb3e434..4653bf74ad 100644 --- a/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md +++ b/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md @@ -105,8 +105,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_processing_stream_of_data_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md index b4c8dfb0b9..63c2fafb1b 100644 --- a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md +++ b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md @@ -102,8 +102,8 @@ This search is to detect a suspicious bcdedit.exe execution to ignore all failur #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **prevent_automatic_repair_mode_using_bcdedit_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-recon_using_wmi_class.md b/docs/_posts/2021-06-10-recon_using_wmi_class.md index d8de0164f3..4c8d730be6 100644 --- a/docs/_posts/2021-06-10-recon_using_wmi_class.md +++ b/docs/_posts/2021-06-10-recon_using_wmi_class.md @@ -100,8 +100,8 @@ The following analytic identifies suspicious PowerShell via EventCode 4104, wher #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **recon_using_wmi_class_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md b/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md index 6e8073b494..35dc4c2b53 100644 --- a/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md +++ b/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md @@ -100,8 +100,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **wmi_recon_running_process_or_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md index d4cd44e404..f41f7f15d2 100644 --- a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md +++ b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md @@ -107,8 +107,8 @@ This analytic will identify suspicious process of cscript.exe where it tries to #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **execute_javascript_with_jscript_com_clsid_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md b/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md index 937bb94c5e..85426be232 100644 --- a/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md +++ b/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md @@ -106,8 +106,8 @@ This search is to detect a suspicious enabling of smb1protocol through "powershe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_enable_smb1protocol_feature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md index 5016caf9db..eb65981ea1 100644 --- a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md +++ b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md @@ -107,9 +107,9 @@ This search is to detect a suspicious commandline designed to delete files or di #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **recursive_delete_of_directory_in_batch_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md index 2e6ea9a74d..bfc3e0d66e 100644 --- a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md +++ b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md @@ -108,8 +108,8 @@ This search is to detect a suspicious modification of firewall to allow file and #### Macros The SPL above uses the following Macros: * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **allow_file_and_printing_sharing_in_firewall_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md index 4159341610..f6419290a6 100644 --- a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md +++ b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md @@ -108,8 +108,8 @@ This search is to detect a suspicious modification to the firewall to allow netw #### Macros The SPL above uses the following Macros: * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **allow_network_discovery_in_firewall_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md index c25832cc7b..ef62d7eafc 100644 --- a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md +++ b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md @@ -108,8 +108,8 @@ This detection targets behaviors observed when threat actors have used sc.exe to #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **excessive_number_of_service_control_start_as_disabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md index 2ce03df914..a0f829606a 100644 --- a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md +++ b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md @@ -117,8 +117,8 @@ During triage, isolate the endpoint and review for source of exploitation. Captu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **print_spooler_adding_a_printer_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md index 081961e406..d5094a4a8e 100644 --- a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md +++ b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md @@ -118,8 +118,8 @@ During triage, isolate the endpoint and review for source of exploitation. Captu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **print_spooler_failed_to_load_a_plug-in_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md index 1ba3a1ef1b..57fa4e8b70 100644 --- a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md +++ b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md @@ -115,8 +115,8 @@ The following analytic identifies a suspicious child process, `rundll32.exe`, wi #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **spoolsv_spawning_rundll32_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md index 6a27da8bc7..d736ada874 100644 --- a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md +++ b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md @@ -111,8 +111,8 @@ This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in no #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **msmpeng_application_dll_side_loading_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md index 7842e34ab8..b7f5ee265e 100644 --- a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md +++ b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md @@ -107,9 +107,9 @@ This search is to identifies a modification in registry to disable the windows d #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **powershell_disable_security_monitoring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md index cc2b500868..9c8e890bd2 100644 --- a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md +++ b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md @@ -122,8 +122,8 @@ This search looks for cloud compute instances created by users who have not crea #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **cloud_compute_instance_created_by_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md index 18015756a1..6897b647f6 100644 --- a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md +++ b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md @@ -109,8 +109,8 @@ This search is to detect a suspicious mshta.exe process that spawn rundll32 or r The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **mshta_spawning_rundll32_or_regsvr32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md index cb00cd3555..1a8abd0c7d 100644 --- a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md +++ b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md @@ -107,9 +107,9 @@ this search is to detect a suspicious office product process that spawn cmd chil #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **office_product_spawn_cmd_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md b/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md index ba50bfd6fb..1f08a24b4d 100644 --- a/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md +++ b/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md @@ -112,8 +112,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_copy_of_shadowcopy_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md index 28900d90cb..fa9fa4b335 100644 --- a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md +++ b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md @@ -108,8 +108,8 @@ This search is to detect a suspicious rundll32.exe commandline to execute dll fi #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_icedid_rundll32_cmdline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md index d98db3cc5a..14846a2e0e 100644 --- a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md +++ b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md @@ -108,8 +108,8 @@ This search is to detect a suspicious rundll32.exe process with plugininit param #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_rundll32_plugininit_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-27-chcp_command_execution.md b/docs/_posts/2021-07-27-chcp_command_execution.md index b665569a64..e779aef587 100644 --- a/docs/_posts/2021-07-27-chcp_command_execution.md +++ b/docs/_posts/2021-07-27-chcp_command_execution.md @@ -102,8 +102,8 @@ This search is to detect execution of chcp.exe application. this utility is used #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **chcp_command_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md index 72410a121d..27cbb5c585 100644 --- a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md +++ b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md @@ -110,8 +110,8 @@ The following analytic identifies Regsvr32.exe utilizing the silent switch to lo #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **regsvr32_with_known_silent_switch_cmdline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md index a4b6fb562c..ae7b48391d 100644 --- a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md +++ b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md @@ -108,8 +108,8 @@ this detection was designed to identifies suspicious spawned process of known MS #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **office_application_spawn_regsvr32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md index 96458e18c1..9da25e52ad 100644 --- a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md +++ b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md @@ -107,8 +107,8 @@ This search is to detect a suspicious un-installation of application using msiex #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **uninstall_app_using_msiexec_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-11-fsutil_zeroing_file.md b/docs/_posts/2021-08-11-fsutil_zeroing_file.md index cf2f3085c5..d250310e6a 100644 --- a/docs/_posts/2021-08-11-fsutil_zeroing_file.md +++ b/docs/_posts/2021-08-11-fsutil_zeroing_file.md @@ -102,8 +102,8 @@ This search is to detect a suspicious fsutil process to zeroing a target file. T #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **fsutil_zeroing_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md index 2ffcffc326..e9fe2ca201 100644 --- a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md +++ b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md @@ -107,8 +107,8 @@ This search is to detect a suspicious 7z process with commandline pointing to SM #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **7zip_commandline_to_smb_share_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-18-esentutl_sam_copy.md b/docs/_posts/2021-08-18-esentutl_sam_copy.md index a6c235bac4..0be02ff4ba 100644 --- a/docs/_posts/2021-08-18-esentutl_sam_copy.md +++ b/docs/_posts/2021-08-18-esentutl_sam_copy.md @@ -107,9 +107,9 @@ The following analytic identifies the process - `esentutl.exe` - being used to c #### Macros The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_esentutl](https://github.com/splunk/security_content/blob/develop/macros/process_esentutl.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **esentutl_sam_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md index 60c6036b42..cd7873937d 100644 --- a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md +++ b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md @@ -105,8 +105,8 @@ The following analytic identifies cleartext protocols at risk of leaking sensiti #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **protocols_passing_authentication_in_cleartext_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-20-github_commit_changes_in_master.md b/docs/_posts/2021-08-20-github_commit_changes_in_master.md index 0db42eec42..b176886222 100644 --- a/docs/_posts/2021-08-20-github_commit_changes_in_master.md +++ b/docs/_posts/2021-08-20-github_commit_changes_in_master.md @@ -101,8 +101,8 @@ This search is to detect a pushed or commit to master or main branch. This is to #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **github_commit_changes_in_master_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md index 3fbd261d84..55b0cd8cf1 100644 --- a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md +++ b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **getlocaluser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md index 1ae86ca355..65ed551ddb 100644 --- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md +++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **getwmiobject_user_account_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md index 5154dc678b..6a544a3ab2 100644 --- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md +++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getwmiobject_user_account_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md index 5f2ea3159e..ea9a9b6194 100644 --- a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md +++ b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **adsisearcher_account_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md index 2ed18073be..6161794c2a 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **domain_account_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md index 9447086524..b006f6f12e 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md @@ -107,9 +107,9 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **domain_account_discovery_with_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md index 35ae4c525e..0f8edcb217 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **domain_account_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md index ea11ee0232..1c692cdaee 100644 --- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md +++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md @@ -102,8 +102,8 @@ This analytic identifies Get-DomainTrust from PowerView in order to gather domai #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **get-domaintrust_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md index 73f076029d..05ece5ca7d 100644 --- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md @@ -102,8 +102,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **get-domaintrust_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell.md b/docs/_posts/2021-08-24-get_aduser_with_powershell.md index 0a1bc88c75..99d7a6b93d 100644 --- a/docs/_posts/2021-08-24-get_aduser_with_powershell.md +++ b/docs/_posts/2021-08-24-get_aduser_with_powershell.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **get_aduser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md b/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md index 983227c015..2885ec9bca 100644 --- a/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **get_aduser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md index 00faa196d4..5e3ccc9ec7 100644 --- a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md +++ b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **get_domainuser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md index 4b1da86585..12ffa406ce 100644 --- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md +++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **getwmiobject_ds_user_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md index 85d80cf3e0..c090f4f54a 100644 --- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getwmiobject_ds_user_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md index db880108c1..d63185fdba 100644 --- a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md +++ b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md @@ -111,8 +111,8 @@ This search uses the Kubernetes logs from Splunk Connect from Kubernetes to dete #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [kube_objects_events](https://github.com/splunk/security_content/blob/develop/macros/kube_objects_events.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **kubernetes_scanner_image_pulling_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md b/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md index 1d73972dff..56e7aa0105 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **domain_group_discovery_with_adsisearcher_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md index 346c0b4ae4..aa06e4111a 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `net.exe` with command-line arguments u #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **domain_group_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md index 5549827dd9..53315ed956 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **domain_group_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md index cd7c57ded7..eb3df3262c 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-l #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **elevated_group_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md index 98c721908f..95bcfb93d3 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **elevated_group_discovery_with_powerview_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md index f31eb06efa..289891f3b1 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **elevated_group_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-getadgroup_with_powershell.md b/docs/_posts/2021-08-25-getadgroup_with_powershell.md index c1130fdbc7..78d29754ca 100644 --- a/docs/_posts/2021-08-25-getadgroup_with_powershell.md +++ b/docs/_posts/2021-08-25-getadgroup_with_powershell.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **getadgroup_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md index a166e237ad..bd53c4c7a6 100644 --- a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md +++ b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **getdomaingroup_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md index b56d16194b..ad340cae7a 100644 --- a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md +++ b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line util #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **getnettcpconnection_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md index 3db9586806..4ec21d1676 100644 --- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md +++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **getwmiobject_ds_group_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md index 1459f1acb7..52ea5b8660 100644 --- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md +++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getwmiobject_ds_group_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md index 5d25f49cba..b95ef0b2e8 100644 --- a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` executing the Get-ADDe #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **get_addefaultdomainpasswordpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md index e278c8d820..2e9ec509b7 100644 --- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` executing the Get ADUs #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **get_aduserresultantpasswordpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md index 3d7f3879c5..ff79a04102 100644 --- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md @@ -100,8 +100,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **get_aduserresultantpasswordpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md index c2e1d92b4b..68210802d9 100644 --- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` executing the `Get-Dom #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **get_domainpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md index f458409ba1..ee64ac4113 100644 --- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md @@ -100,8 +100,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **get_domainpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md b/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md index 7b0607e962..545ab393fc 100644 --- a/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getdomaingroup_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md index 4cdf009cfa..7f195b6c3d 100644 --- a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md +++ b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command li #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **password_policy_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md index d8b606a7ef..b15a922a25 100644 --- a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md +++ b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md @@ -121,8 +121,8 @@ This search looks for a process launching an `*.lnk` file under `C:\User*` or `* #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **process_creating_lnk_file_in_suspicious_location_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md index 27495bc909..a4109f88e7 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md +++ b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md @@ -107,8 +107,8 @@ Review the source attempting to perform this activity against your environment. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [exchange](https://github.com/splunk/security_content/blob/develop/macros/exchange.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **exchange_powershell_abuse_via_ssrf_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md index 4ed53fb857..38f8098ad8 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md +++ b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md @@ -111,8 +111,8 @@ Module - New-managementroleassignment can assign a management role to a manageme #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **exchange_powershell_module_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md index 8b4e1daf49..a7a7709f4a 100644 --- a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md +++ b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `nltest.exe` with command-line argument #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **domain_controller_discovery_with_nltest_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md index 34de9a917a..933e997068 100644 --- a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md +++ b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **remote_system_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md index f04ca91335..1526c5c5e8 100644 --- a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md +++ b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **remote_system_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-circle_ci_disable_security_step.md b/docs/_posts/2021-09-01-circle_ci_disable_security_step.md index 9e27a6d39f..71a252f6f8 100644 --- a/docs/_posts/2021-09-01-circle_ci_disable_security_step.md +++ b/docs/_posts/2021-09-01-circle_ci_disable_security_step.md @@ -117,8 +117,8 @@ This search looks for disable security step in CircleCI pipeline. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [circleci](https://github.com/splunk/security_content/blob/develop/macros/circleci.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **circle_ci_disable_security_step_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md index fed4ecbd94..6158e6df76 100644 --- a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md +++ b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **domain_controller_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md index 5bbe8e09bc..9534f2d6fd 100644 --- a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md +++ b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **domain_group_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md index b9e7f01b8a..9f6011c46d 100644 --- a/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getadcomputer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md index 9170f1ee06..9ef16fa75a 100644 --- a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getwmiobject_ds_computer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-github_commit_in_develop.md b/docs/_posts/2021-09-01-github_commit_in_develop.md index e2886e38e9..2eef99dca3 100644 --- a/docs/_posts/2021-09-01-github_commit_in_develop.md +++ b/docs/_posts/2021-09-01-github_commit_in_develop.md @@ -101,8 +101,8 @@ This search is to detect a pushed or commit to develop branch. This is to avoid #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **github_commit_in_develop_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-github_dependabot_alert.md b/docs/_posts/2021-09-01-github_dependabot_alert.md index 8e071247fe..fd2a212384 100644 --- a/docs/_posts/2021-09-01-github_dependabot_alert.md +++ b/docs/_posts/2021-09-01-github_dependabot_alert.md @@ -113,8 +113,8 @@ This search looks for Dependabot Alerts in Github logs. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **github_dependabot_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md index 5472ee8db6..986599f6e5 100644 --- a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md +++ b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md @@ -114,9 +114,9 @@ This search looks for Pull Request from unknown user. #### Macros The SPL above uses the following Macros: +* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [github_known_users](https://github.com/splunk/security_content/blob/develop/macros/github_known_users.yml) -* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) > :information_source: > **github_pull_request_from_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md b/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md index 4f4365757b..f62c1c6ce5 100644 --- a/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md +++ b/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **remote_system_discovery_with_adsisearcher_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md index eea36a44e0..d2cbc9336e 100644 --- a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md +++ b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **remote_system_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-02-circle_ci_disable_security_job.md b/docs/_posts/2021-09-02-circle_ci_disable_security_job.md index 735373a9e4..136c9bacd3 100644 --- a/docs/_posts/2021-09-02-circle_ci_disable_security_job.md +++ b/docs/_posts/2021-09-02-circle_ci_disable_security_job.md @@ -113,8 +113,8 @@ This search looks for disable security job in CircleCI pipeline. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [circleci](https://github.com/splunk/security_content/blob/develop/macros/circleci.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **circle_ci_disable_security_job_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md index 35ff69f6e7..dfa36ed572 100644 --- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md +++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md @@ -102,8 +102,8 @@ This analytic identifies Get-ForestTrust from PowerSploit in order to gather dom #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **get-foresttrust_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md index daeb19634d..6004b1416c 100644 --- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md @@ -102,8 +102,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **get-foresttrust_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md b/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md index e820fccf06..f35dfdad93 100644 --- a/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getdomaincomputer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md b/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md index 97f3ed9faf..6438259673 100644 --- a/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getdomaincontroller_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md index 88e16dfd41..ac2289bd7c 100644 --- a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md +++ b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md @@ -102,8 +102,8 @@ This search is to detect a suspicious bcdedit commandline to configure the host #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **bcdedit_command_back_to_normal_mode_boot_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md index bd0b7da87a..fda1a61b06 100644 --- a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md +++ b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md @@ -102,8 +102,8 @@ This search is to detect a suspicious bcdedit commandline to configure the host #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **change_to_safe_mode_with_network_config_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md index f651563fe7..90bf4429ed 100644 --- a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md +++ b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **getadcomputer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md index 518a0b9f38..713fbc5000 100644 --- a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md +++ b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **getdomaincomputer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md index fce0306599..d908a9d014 100644 --- a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md +++ b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **getdomaincontroller_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md index db435f2c37..fb7d6d46cf 100644 --- a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md +++ b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **getwmiobject_ds_computer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-07-system_information_discovery_detection.md b/docs/_posts/2021-09-07-system_information_discovery_detection.md index 6284fd84fb..a1f26d2874 100644 --- a/docs/_posts/2021-09-07-system_information_discovery_detection.md +++ b/docs/_posts/2021-09-07-system_information_discovery_detection.md @@ -110,8 +110,8 @@ Detect system information discovery techniques used by attackers to understand c #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **system_information_discovery_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md index 48003e4082..594531298f 100644 --- a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md +++ b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md @@ -112,8 +112,8 @@ The following detection identifies control.exe loading either a .cpl or .inf fro #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **control_loading_from_world_writable_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md index fd396ad9ae..d82a61ca56 100644 --- a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md +++ b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md @@ -112,8 +112,8 @@ This search looks for the creation of local administrator accounts using net.exe #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **create_local_admin_accounts_using_net_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-08-office_spawning_control.md b/docs/_posts/2021-09-08-office_spawning_control.md index 524134cc6c..aec0d7cc2e 100644 --- a/docs/_posts/2021-09-08-office_spawning_control.md +++ b/docs/_posts/2021-09-08-office_spawning_control.md @@ -112,8 +112,8 @@ The following detection identifies control.exe spawning from an office product. #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **office_spawning_control_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md index d3c5f687fc..a6cbdb54f1 100644 --- a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md +++ b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md @@ -113,8 +113,8 @@ The following hunting detection identifies rundll32.exe with `control_rundll` wi #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **rundll32_control_rundll_hunt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md index be6923c996..d74d500fcd 100644 --- a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md +++ b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md @@ -113,8 +113,8 @@ The following detection identifies rundll32.exe with `control_rundll` within the #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **rundll32_control_rundll_world_writable_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-09-extraction_of_registry_hives.md b/docs/_posts/2021-09-09-extraction_of_registry_hives.md index a39d5f8422..de39548248 100644 --- a/docs/_posts/2021-09-09-extraction_of_registry_hives.md +++ b/docs/_posts/2021-09-09-extraction_of_registry_hives.md @@ -107,9 +107,9 @@ The following analytic identifies the use of `reg.exe` exporting Windows Registr #### Macros The SPL above uses the following Macros: +* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) > :information_source: > **extraction_of_registry_hives_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md b/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md index 0d5361e0f4..9cbc7d7180 100644 --- a/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md +++ b/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getnettcpconnection_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md index e21ffecea2..c89ce7ea75 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `arp.exe` utilized to get a listing of #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **network_connection_discovery_with_arp_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md index 155e7de23b..309880bcb5 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `net.exe` with command-line arguments u #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **network_connection_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md index 810c81f80b..02afe963b8 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `netstat.exe` with command-line argumen #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **network_connection_discovery_with_netstat_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md index d0d660741e..7e6072e5ca 100644 --- a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md +++ b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powerhsell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **getcurrent_user_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md index 86b5c55d90..8ffd3e7b82 100644 --- a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md +++ b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md @@ -107,8 +107,8 @@ This search is to detect a execution of jscript using cscript process. Commonly #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **jscript_execution_using_cscript_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_query.md b/docs/_posts/2021-09-13-system_user_discovery_with_query.md index b62e73bfdf..3d5f542883 100644 --- a/docs/_posts/2021-09-13-system_user_discovery_with_query.md +++ b/docs/_posts/2021-09-13-system_user_discovery_with_query.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `query.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **system_user_discovery_with_query_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md index 027b3910fe..6c269f5979 100644 --- a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md +++ b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `whoami.exe` without any arguments. Thi #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **system_user_discovery_with_whoami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md index 92435c9d5c..52e651933e 100644 --- a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md +++ b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md @@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **user_discovery_with_env_vars_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md index 39c3fd69f7..d16a8f74c7 100644 --- a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md +++ b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md @@ -103,8 +103,8 @@ This search is to detect a suspicious wmic.exe process or renamed wmic process t #### Macros The SPL above uses the following Macros: * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **xsl_script_execution_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md index f2b0e43e0d..d1a4c191e5 100644 --- a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md +++ b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md @@ -107,8 +107,8 @@ The following analytic identifies a non-standard parent process (not matching CM #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **cmdline_tool_not_executed_in_cmd_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md index 624f0c31d3..0c112c1c9b 100644 --- a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md +++ b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md @@ -107,8 +107,8 @@ The following hunting analytic identifies the use of `Get-WMIObject Win32_Group` #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **get_wmiobject_group_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-14-net_localgroup_discovery.md b/docs/_posts/2021-09-14-net_localgroup_discovery.md index 0284a73976..c71e0bfd9a 100644 --- a/docs/_posts/2021-09-14-net_localgroup_discovery.md +++ b/docs/_posts/2021-09-14-net_localgroup_discovery.md @@ -107,8 +107,8 @@ The following hunting analytic will identify the use of localgroup discovery usi #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **net_localgroup_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md index 3356fed25c..d1cfcb3cc0 100644 --- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md +++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md @@ -107,8 +107,8 @@ The following hunting analytic identifies the use of `get-localgroup` being used #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **powershell_get_localgroup_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md index 406541d7d5..96189c8f79 100644 --- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md +++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md @@ -107,8 +107,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_get_localgroup_discovery_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-14-wmic_group_discovery.md b/docs/_posts/2021-09-14-wmic_group_discovery.md index c697bf5232..4934e04504 100644 --- a/docs/_posts/2021-09-14-wmic_group_discovery.md +++ b/docs/_posts/2021-09-14-wmic_group_discovery.md @@ -109,8 +109,8 @@ During triage, review parallel processes and identify any further suspicious beh #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **wmic_group_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md index 4c8a4013eb..694618f1b7 100644 --- a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md +++ b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md @@ -102,8 +102,8 @@ This search is to detect a suspicious whoami execution to check if the cmd or sh #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **check_elevated_cmd_using_whoami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-account_discovery_with_net_app.md b/docs/_posts/2021-09-16-account_discovery_with_net_app.md index a0a76338f0..ef8f22531b 100644 --- a/docs/_posts/2021-09-16-account_discovery_with_net_app.md +++ b/docs/_posts/2021-09-16-account_discovery_with_net_app.md @@ -108,9 +108,9 @@ this search is to detect a potential account discovery series of command used by #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **account_discovery_with_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md index 7b0a826dbb..1ce1a64c89 100644 --- a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md +++ b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md @@ -116,9 +116,9 @@ Attempt To Add Certificate To Untrusted Store #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **attempt_to_add_certificate_to_untrusted_store_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md index 03592ce7d2..8ee59db57a 100644 --- a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md +++ b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md @@ -113,10 +113,10 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th #### Macros The SPL above uses the following Macros: +* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) > :information_source: > **attempted_credential_dump_from_registry_via_reg_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-bits_job_persistence.md b/docs/_posts/2021-09-16-bits_job_persistence.md index 4bacba5373..65b5026013 100644 --- a/docs/_posts/2021-09-16-bits_job_persistence.md +++ b/docs/_posts/2021-09-16-bits_job_persistence.md @@ -103,9 +103,9 @@ The following query identifies Microsoft Background Intelligent Transfer Service #### Macros The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **bits_job_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-bitsadmin_download_file.md b/docs/_posts/2021-09-16-bitsadmin_download_file.md index b7c07192d5..e430f829c2 100644 --- a/docs/_posts/2021-09-16-bitsadmin_download_file.md +++ b/docs/_posts/2021-09-16-bitsadmin_download_file.md @@ -108,9 +108,9 @@ The following query identifies Microsoft Background Intelligent Transfer Service #### Macros The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **bitsadmin_download_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md index 2b93b8622b..d5cdc78b58 100644 --- a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md +++ b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md @@ -113,9 +113,9 @@ This search detects the use of wmic and Powershell to create a shadow copy. #### Macros The SPL above uses the following Macros: * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **creation_of_shadow_copy_with_wmic_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md index 4df0255546..dcf5dcfcc6 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md @@ -112,9 +112,9 @@ This search detects credential dumping using copy command from a shadow copy. #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **credential_dumping_via_copy_command_from_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md index e216f6991c..07f3c1ee10 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md @@ -112,9 +112,9 @@ This search detects the creation of a symlink to a shadow copy. #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **credential_dumping_via_symlink_to_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md index e2b85b66f6..2b0c206d92 100644 --- a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md @@ -112,9 +112,9 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_html_help_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md index d87f495d7a..7adebd9f38 100644 --- a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md +++ b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md @@ -112,9 +112,9 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_html_help_using_infotech_storage_handlers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md index 94be623f27..eacfc71a0e 100644 --- a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md +++ b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md @@ -112,9 +112,9 @@ The following analytic identifies "mshta.exe" execution with inline protocol han #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_mshta_inline_hta_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md index 8b03c85b2b..6e43b419ee 100644 --- a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md @@ -112,9 +112,9 @@ This analytic identifies when Microsoft HTML Application Host (mshta.exe) utilit #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_mshta_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md index 2fb37bbfba..1dea81ca3d 100644 --- a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md +++ b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md @@ -112,9 +112,9 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_psexec_with_accepteula_flag_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_renamed_7-zip.md b/docs/_posts/2021-09-16-detect_renamed_7-zip.md index e00bafd53b..2aa3a5d738 100644 --- a/docs/_posts/2021-09-16-detect_renamed_7-zip.md +++ b/docs/_posts/2021-09-16-detect_renamed_7-zip.md @@ -107,8 +107,8 @@ The following analytic identifies renamed 7-Zip usage using Sysmon. At this stag #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_renamed_7-zip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_renamed_rclone.md b/docs/_posts/2021-09-16-detect_renamed_rclone.md index 0a4eea4ecf..05f75b217e 100644 --- a/docs/_posts/2021-09-16-detect_renamed_rclone.md +++ b/docs/_posts/2021-09-16-detect_renamed_rclone.md @@ -101,8 +101,8 @@ The following analytic identifies the usage of `rclone.exe`, renamed, being used #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_renamed_rclone_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_renamed_winrar.md b/docs/_posts/2021-09-16-detect_renamed_winrar.md index fda3661084..e0a0dee5d6 100644 --- a/docs/_posts/2021-09-16-detect_renamed_winrar.md +++ b/docs/_posts/2021-09-16-detect_renamed_winrar.md @@ -107,8 +107,8 @@ The following analtyic identifies renamed instances of `WinRAR.exe`. In most cas #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_renamed_winrar_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md index b85418080b..cbd7f74e6d 100644 --- a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md +++ b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md @@ -114,9 +114,9 @@ During triage, confirm this is procdump.exe executing. If it is the first time a #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_procdump](https://github.com/splunk/security_content/blob/develop/macros/process_procdump.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **dump_lsass_via_procdump_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_net.md b/docs/_posts/2021-09-16-local_account_discovery_with_net.md index c58d329d7c..f8eb2e3127 100644 --- a/docs/_posts/2021-09-16-local_account_discovery_with_net.md +++ b/docs/_posts/2021-09-16-local_account_discovery_with_net.md @@ -107,9 +107,9 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **local_account_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md index 3be4ca3539..8bbbca5fdd 100644 --- a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md +++ b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md @@ -108,8 +108,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **local_account_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-office_product_spawning_wmic.md b/docs/_posts/2021-09-16-office_product_spawning_wmic.md index bc01d8f37b..11ee174959 100644 --- a/docs/_posts/2021-09-16-office_product_spawning_wmic.md +++ b/docs/_posts/2021-09-16-office_product_spawning_wmic.md @@ -108,8 +108,8 @@ The following detection identifies the latest behavior utilized by Ursnif malwar #### Macros The SPL above uses the following Macros: * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **office_product_spawning_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-processes_launching_netsh.md b/docs/_posts/2021-09-16-processes_launching_netsh.md index d68351a19e..25121ac6e9 100644 --- a/docs/_posts/2021-09-16-processes_launching_netsh.md +++ b/docs/_posts/2021-09-16-processes_launching_netsh.md @@ -113,8 +113,8 @@ This search looks for processes launching netsh.exe. Netsh is a command-line scr #### Macros The SPL above uses the following Macros: * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **processes_launching_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md index b9ffbc646f..cab0d16a04 100644 --- a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md +++ b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md @@ -107,8 +107,8 @@ This search is to detect potential malicious office document executing lolbin ch #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **office_document_spawned_child_process_to_download_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md index db772d6c3f..b2b27c06ed 100644 --- a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md +++ b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md @@ -102,8 +102,8 @@ This search is to detect file creation in remcos folder in appdata which is the #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **remcos_rat_file_creation_in_remcos_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-27-change_default_file_association.md b/docs/_posts/2021-09-27-change_default_file_association.md index 4244fd0b89..cb7c02689c 100644 --- a/docs/_posts/2021-09-27-change_default_file_association.md +++ b/docs/_posts/2021-09-27-change_default_file_association.md @@ -109,8 +109,8 @@ This analytic is developed to detect suspicious registry modification to change #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **change_default_file_association_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md index c9b808f974..c65717412e 100644 --- a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md +++ b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md @@ -109,8 +109,8 @@ This search is to detect a suspicious modification of registry entry to persist #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **logon_script_event_trigger_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md index e692c931a0..b84ed3e5c4 100644 --- a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md +++ b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md @@ -109,8 +109,8 @@ This analytic is developed to detect possible event trigger execution through sc #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **screensaver_event_trigger_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-28-print_processor_registry_autostart.md b/docs/_posts/2021-09-28-print_processor_registry_autostart.md index 7271d312a2..d0cbefcb3b 100644 --- a/docs/_posts/2021-09-28-print_processor_registry_autostart.md +++ b/docs/_posts/2021-09-28-print_processor_registry_autostart.md @@ -111,8 +111,8 @@ This analytic is to detect a suspicious modification or new registry entry regar #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **print_processor_registry_autostart_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-29-verclsid_clsid_execution.md b/docs/_posts/2021-09-29-verclsid_clsid_execution.md index 75b2827a98..5ed0df7318 100644 --- a/docs/_posts/2021-09-29-verclsid_clsid_execution.md +++ b/docs/_posts/2021-09-29-verclsid_clsid_execution.md @@ -107,9 +107,9 @@ This analytic is to detect a possible abuse of verclsid to execute malicious fil #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_verclsid](https://github.com/splunk/security_content/blob/develop/macros/process_verclsid.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_verclsid](https://github.com/splunk/security_content/blob/develop/macros/process_verclsid.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **verclsid_clsid_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md index 542a0c8b46..e3c8f76556 100644 --- a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md +++ b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md @@ -107,8 +107,8 @@ This analytic is to detect a suspicious wscript commandline to execute vbscript. #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **vbscript_execution_using_wscript_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md index 1a8935aa00..18327b1dbb 100644 --- a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md +++ b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md @@ -107,9 +107,9 @@ This analytic is to detect a suspicious child process of MSBuild spawned by Wind #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **msbuild_suspicious_spawned_by_script_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md index f67fb16893..9014907709 100644 --- a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md +++ b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md @@ -110,8 +110,8 @@ This analytic is to detect a loading of dll using regsvr32 application with sile #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **regsvr32_silent_and_install_param_dll_loading_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md index 04b84d8c5e..f72b3e29df 100644 --- a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md +++ b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md @@ -112,8 +112,8 @@ The following analytic identifies a process modifying the registry with a known #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **malicious_inprocserver32_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md index f0c83e517f..f42d4979d5 100644 --- a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md +++ b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md @@ -112,8 +112,8 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **process_writing_dynamicwrapperx_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md index 6ef68b967f..f51ec23ad7 100644 --- a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md +++ b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md @@ -103,8 +103,8 @@ This analytic is to detect a suspicious rundll32 commandline to clear shim cache #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **rundll32_shimcache_flush_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md index 2de92d79aa..e139502ae5 100644 --- a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md +++ b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md @@ -108,8 +108,8 @@ This analytic is to detect a suspicious copy of file from systemroot folder of t #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_copy](https://github.com/splunk/security_content/blob/develop/macros/process_copy.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_copy_on_system32_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md index 899a5b9487..0fbefce559 100644 --- a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md +++ b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md @@ -103,8 +103,8 @@ The following analytic identifies winhlp32.exe, found natively in `c:\windows\`, #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **winhlp32_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-06-sdelete_application_execution.md b/docs/_posts/2021-10-06-sdelete_application_execution.md index 1ada946924..435972ee36 100644 --- a/docs/_posts/2021-10-06-sdelete_application_execution.md +++ b/docs/_posts/2021-10-06-sdelete_application_execution.md @@ -113,8 +113,8 @@ This analytic is to detect the execution of sdelete.exe application sysinternal #### Macros The SPL above uses the following Macros: * [process_sdelete](https://github.com/splunk/security_content/blob/develop/macros/process_sdelete.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **sdelete_application_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md index 4a2f07702a..238d194fdd 100644 --- a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md +++ b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md @@ -121,8 +121,8 @@ This analytic identifies a suspicious spawned process by WScript or CScript proc #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **wscript_or_cscript_suspicious_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md index 1834efe99a..762e377e0f 100644 --- a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md +++ b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md @@ -118,8 +118,8 @@ The wevtutil.exe application is the windows event log utility. This searches for #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_wevtutil_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md index 1d8f99d51b..c6a43b9ce7 100644 --- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md +++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md @@ -104,8 +104,8 @@ During triage, review parallel processes for further suspicious activity. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **serviceprincipalnames_discovery_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md index 169275b0e6..14fed43740 100644 --- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md +++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md @@ -109,9 +109,9 @@ During triage, review parallel processes for further suspicious activity. #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_setspn](https://github.com/splunk/security_content/blob/develop/macros/process_setspn.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **serviceprincipalnames_discovery_with_setspn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-18-disable_schedule_task.md b/docs/_posts/2021-10-18-disable_schedule_task.md index cc6eee3d12..1b4cfa60ad 100644 --- a/docs/_posts/2021-10-18-disable_schedule_task.md +++ b/docs/_posts/2021-10-18-disable_schedule_task.md @@ -107,8 +107,8 @@ This analytic is to detect a suspicious commandline to disable existing schedule #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **disable_schedule_task_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md index 914973d141..22720e91d1 100644 --- a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md +++ b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md @@ -104,9 +104,9 @@ During triage, review parallel processes for further behavior. In addition, iden #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_curl_download_to_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md b/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md index 34f97c1258..12dc7340c3 100644 --- a/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md +++ b/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md @@ -107,8 +107,8 @@ This analytic is to detect a suspicious wmic commandlined that uninstall applica #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **wmic_noninteractive_app_uninstallation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-03-windows_adfind_exe.md b/docs/_posts/2021-11-03-windows_adfind_exe.md index ff6f6a8875..bd276cdce8 100644 --- a/docs/_posts/2021-11-03-windows_adfind_exe.md +++ b/docs/_posts/2021-11-03-windows_adfind_exe.md @@ -107,8 +107,8 @@ This search looks for the execution of `adfind.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_adfind_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md b/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md index e9d0341f4a..fd0857c133 100644 --- a/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md +++ b/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md @@ -126,8 +126,8 @@ This search looks for execution of commonly used attacker tools on an endpoint. #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **attacker_tools_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md index 36ae640924..fe5471fb42 100644 --- a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md +++ b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md @@ -106,9 +106,9 @@ Adversaries may use one of the three methods based on the remote destination and #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_curl_upload_to_remote_destination_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md index 00688011cc..be55e557b9 100644 --- a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md +++ b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md @@ -109,8 +109,8 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_service_creation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md index e3f0c5a257..30f8951fe7 100644 --- a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md +++ b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md @@ -109,8 +109,8 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_service_initiation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md index 5bb1da6c62..4adbe759e9 100644 --- a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md +++ b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `winrs.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **remote_process_instantiation_via_winrm_and_winrs_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md index d5f4812d79..9efa6c3b0c 100644 --- a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md +++ b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md @@ -111,8 +111,8 @@ This analytic looks for the execution of `at.exe` with command-line arguments ut #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **scheduled_task_creation_on_remote_endpoint_using_at_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md index 7c615d89a5..8f7eb63971 100644 --- a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md +++ b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md @@ -111,8 +111,8 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **scheduled_task_initiation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md index 6e8a86eaef..284af4d9fc 100644 --- a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md +++ b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md @@ -103,8 +103,8 @@ The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible St #### Macros The SPL above uses the following Macros: * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **wmic_xsl_execution_via_url_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md index 3a1c7dbb39..e393521d7a 100644 --- a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md +++ b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md @@ -107,9 +107,9 @@ this analytic is to detect a suspicious compile before delivery approach of .net #### Macros The SPL above uses the following Macros: +* [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml) > :information_source: > **csc_net_on_the_fly_compilation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-firewall_allowed_program_enable.md b/docs/_posts/2021-11-12-firewall_allowed_program_enable.md index 73fc2febe1..53ded3f04c 100644 --- a/docs/_posts/2021-11-12-firewall_allowed_program_enable.md +++ b/docs/_posts/2021-11-12-firewall_allowed_program_enable.md @@ -107,8 +107,8 @@ This analytic detects a potential suspicious modification of firewall rule allow #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **firewall_allowed_program_enable_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md index 5815a33c8f..dfdeda3039 100644 --- a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md +++ b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md @@ -107,9 +107,9 @@ This analytic look for a spawned process of route.exe windows application. Adver #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_route](https://github.com/splunk/security_content/blob/develop/macros/process_route.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **network_discovery_using_route_windows_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md index f061dea140..622f31b0c1 100644 --- a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md +++ b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md @@ -111,8 +111,8 @@ This analytic identifies wmic.exe being launched with parameters to spawn a proc #### Macros The SPL above uses the following Macros: * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **remote_process_instantiation_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-runas_execution_in_commandline.md b/docs/_posts/2021-11-12-runas_execution_in_commandline.md index b880fd8656..44ab86c0bc 100644 --- a/docs/_posts/2021-11-12-runas_execution_in_commandline.md +++ b/docs/_posts/2021-11-12-runas_execution_in_commandline.md @@ -110,8 +110,8 @@ This analytic look for a spawned runas.exe process with a administrator user opt #### Macros The SPL above uses the following Macros: * [process_runas](https://github.com/splunk/security_content/blob/develop/macros/process_runas.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **runas_execution_in_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md index 1eb00cabc5..55bc046bbd 100644 --- a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md +++ b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md @@ -112,8 +112,8 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_installutil_uninstall_option_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md index 528f6b0294..c2736e0ce1 100644 --- a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md +++ b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md @@ -111,8 +111,8 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_installutil_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md index 487bed8e17..73a0c311f5 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md @@ -107,9 +107,9 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **remote_process_instantiation_via_dcom_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md index a851c73030..f50a85740c 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md @@ -102,9 +102,9 @@ This analytic looks for the execution of `powershell.exe` leveraging the `Invoke #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **remote_process_instantiation_via_wmi_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md index 7b124d8434..b8856a3372 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **remote_process_instantiation_via_wmi_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-15-windows_diskcryptor_usage.md b/docs/_posts/2021-11-15-windows_diskcryptor_usage.md index f6a1e66377..9d36129ad0 100644 --- a/docs/_posts/2021-11-15-windows_diskcryptor_usage.md +++ b/docs/_posts/2021-11-15-windows_diskcryptor_usage.md @@ -102,8 +102,8 @@ The following analytic identifies DiskCryptor process name of dcrypt.exe or int #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_diskcryptor_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md index e8b4827906..458e515aef 100644 --- a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md +++ b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md @@ -107,9 +107,9 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **remote_process_instantiation_via_winrm_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-17-windows_dism_remove_defender.md b/docs/_posts/2021-11-17-windows_dism_remove_defender.md index de4bb52790..407e0e576c 100644 --- a/docs/_posts/2021-11-17-windows_dism_remove_defender.md +++ b/docs/_posts/2021-11-17-windows_dism_remove_defender.md @@ -107,8 +107,8 @@ The following analytic identifies the use of the Windows Disk Image Utility, `di #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_dism_remove_defender_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md index 906c6e84dd..f2e189df34 100644 --- a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md +++ b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md @@ -102,8 +102,8 @@ This analytic is to detect a suspicious dxdiag.exe process command-line executio #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_dxdiag](https://github.com/splunk/security_content/blob/develop/macros/process_dxdiag.yml) > :information_source: diff --git a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md index 0302e0e287..a240857b3c 100644 --- a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md +++ b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md @@ -107,8 +107,8 @@ This analytic will detect if a suspicious process contains a commandline paramet #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **possible_browser_pass_view_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md index 4a7df02b80..f1d26ef0d2 100644 --- a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md @@ -109,8 +109,8 @@ The following analytic identifies `services.exe` spawning a LOLBAS execution pro #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **services_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md index 6393b95a4f..49d8668e14 100644 --- a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md @@ -111,8 +111,8 @@ The following analytic identifies `svchost.exe` spawning a LOLBAS execution proc #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **svchost_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md index b547469c0b..44e6b12703 100644 --- a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md +++ b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md @@ -105,8 +105,8 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_service_created_with_suspicious_service_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md index ddf621fad7..1c40def6e4 100644 --- a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md +++ b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md @@ -107,8 +107,8 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_service_created_within_public_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md index 5020e994f5..479ec8abb8 100644 --- a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md @@ -102,8 +102,8 @@ The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution pro #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **wmiprsve_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md index 4f98add5e0..cc5641f5df 100644 --- a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md @@ -107,8 +107,8 @@ The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS execution #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **wsmprovhost_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md index cc8520ac4b..e794dc5af9 100644 --- a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md @@ -107,8 +107,8 @@ The following analytic identifies `mmc.exe` spawning a LOLBAS execution process. #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **mmc_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md b/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md index fd75d5de84..c4f1f46cc0 100644 --- a/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md +++ b/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md @@ -107,8 +107,8 @@ This analytic will identify a suspicious process command-line related to Windows #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **add_or_set_windows_defender_exclusion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md b/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md index 9d367f82a9..6c2914b698 100644 --- a/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md +++ b/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md @@ -106,8 +106,8 @@ This analytic will detect a suspicious process commandline related to windows de #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_windows_defender_exclusion_commands_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md index c1aa40bed2..bb1802f83a 100644 --- a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md +++ b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md @@ -102,9 +102,9 @@ This analytic identifies commonly used command-line arguments used by `rclone.ex #### Macros The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_rclone](https://github.com/splunk/security_content/blob/develop/macros/process_rclone.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_rclone_command-line_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md index c37740f512..7b27f7aed5 100644 --- a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md +++ b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md @@ -135,8 +135,8 @@ The following analytic assists with identifying a PowerShell process spawned as #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **possible_lateral_movement_powershell_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md b/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md index 27fc81bebd..f70a9508fb 100644 --- a/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md +++ b/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md @@ -107,8 +107,8 @@ The search logic specifically looks for high number of distinct commands run in #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_linux_discovery_commands_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md b/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md index 1979e02a34..2ef2e5e6e0 100644 --- a/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md +++ b/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md @@ -102,8 +102,8 @@ The following analytic identifies the Raccine Rules Updater scheduled task being #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_raccine_scheduled_task_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md index 0581a6cb2e..0c8c4f2440 100644 --- a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md +++ b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md @@ -108,8 +108,8 @@ The following analytic identifies the use of curl on Linux or MacOS attempting t #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **curl_download_and_bash_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md index bfed14bc43..3247414e8f 100644 --- a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md +++ b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md @@ -108,8 +108,8 @@ The following analytic identifies the use of wget on Linux or MacOS attempting t #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **wget_download_and_bash_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-13-linux_java_spawning_shell.md b/docs/_posts/2021-12-13-linux_java_spawning_shell.md index 3df3737a0f..5d26459021 100644 --- a/docs/_posts/2021-12-13-linux_java_spawning_shell.md +++ b/docs/_posts/2021-12-13-linux_java_spawning_shell.md @@ -107,9 +107,9 @@ The following analytic identifies the process name of Java, Apache, or Tomcat sp #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [linux_shells](https://github.com/splunk/security_content/blob/develop/macros/linux_shells.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_java_spawning_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md index be6c7be8fc..09319deb53 100644 --- a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md +++ b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md @@ -124,8 +124,8 @@ CVE-2021-44228 Log4Shell payloads can be injected via various methods, but on of #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **log4shell_jndi_payload_injection_with_outbound_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md index 53c949a349..83df26299f 100644 --- a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md +++ b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md @@ -111,8 +111,8 @@ A required step while exploiting the CVE-2021-44228-Log4j vulnerability is that #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **outbound_network_connection_from_java_using_default_ports_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-13-windows_java_spawning_shells.md b/docs/_posts/2021-12-13-windows_java_spawning_shells.md index caf8677161..e831d6cb09 100644 --- a/docs/_posts/2021-12-13-windows_java_spawning_shells.md +++ b/docs/_posts/2021-12-13-windows_java_spawning_shells.md @@ -109,9 +109,9 @@ The following analytic identifies the process name of java.exe and w3wp.exe spaw #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_java_spawning_shells_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md b/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md index 42cc8ce213..7a887aa3c0 100644 --- a/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md +++ b/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md @@ -117,8 +117,8 @@ The following analytic identifies a suspicious file creation in known cron table #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_add_files_in_known_crontab_directories_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md b/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md index 47319dbe9c..bb6a258cfd 100644 --- a/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md +++ b/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md @@ -117,8 +117,8 @@ The following analytic identifies a suspicious file creation of /etc/at.allow or #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_at_allow_config_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md b/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md index 6d59c78222..953ced99a4 100644 --- a/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md +++ b/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md @@ -117,8 +117,8 @@ The following analytic identifies a suspicious cronjobs modification using cront #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_edit_cron_table_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md b/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md index 48da01550b..03a9fd16f5 100644 --- a/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md +++ b/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md @@ -117,8 +117,8 @@ This analytic looks for possible suspicious commandline that may use to append a #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md b/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md index 74e771fcd1..ed0ee79276 100644 --- a/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md +++ b/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md @@ -117,8 +117,8 @@ This analytic looks for possible modification of cronjobs file using editor. Thi #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_possible_cronjob_modification_with_editor_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md b/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md index 8a5ef21df0..6f00971b99 100644 --- a/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md +++ b/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md @@ -115,8 +115,8 @@ This analytic looks for suspicious file creation on init system directories for #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_file_creation_in_init_boot_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md b/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md index b0fe1a2c23..2dbf6a99e7 100644 --- a/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md +++ b/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md @@ -115,8 +115,8 @@ This analytic looks for suspicious file creation in /etc/profile.d directory to #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_file_creation_in_profile_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md b/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md index dd50e5d092..a9fdbc8fcb 100644 --- a/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md +++ b/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md @@ -115,8 +115,8 @@ This analytic looks for suspicious command-lines that can be possibly used to mo #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_possible_append_command_to_profile_config_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md b/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md index 84593309e0..987f16168d 100644 --- a/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md +++ b/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md @@ -117,8 +117,8 @@ This analytic looks for suspicious file creation in systemd timer directory in l #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_service_file_created_in_systemd_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-20-linux_service_restarted.md b/docs/_posts/2021-12-20-linux_service_restarted.md index 07b80b63ae..f35765c93a 100644 --- a/docs/_posts/2021-12-20-linux_service_restarted.md +++ b/docs/_posts/2021-12-20-linux_service_restarted.md @@ -117,8 +117,8 @@ This analytic looks for restarted or re-enable services in linux platform. This #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_service_restarted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-20-linux_service_started_or_enabled.md b/docs/_posts/2021-12-20-linux_service_started_or_enabled.md index 8b5aa7f4d1..eec3c468b0 100644 --- a/docs/_posts/2021-12-20-linux_service_started_or_enabled.md +++ b/docs/_posts/2021-12-20-linux_service_started_or_enabled.md @@ -117,8 +117,8 @@ This analytic looks for created or enable services in linux platform. This techn #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_service_started_or_enabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-21-linux_add_user_account.md b/docs/_posts/2021-12-21-linux_add_user_account.md index 73ed7ae760..9584b01ede 100644 --- a/docs/_posts/2021-12-21-linux_add_user_account.md +++ b/docs/_posts/2021-12-21-linux_add_user_account.md @@ -113,8 +113,8 @@ This analytic looks for commands to create user accounts on the linux platform. #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_add_user_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md b/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md index 1ee27b641b..35bdfcb666 100644 --- a/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md +++ b/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md @@ -113,8 +113,8 @@ This analytic looks for a commandline that change the file owner to root using c #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_change_file_owner_to_root_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md b/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md index ff9d2ee30f..31ddc7dcaa 100644 --- a/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md +++ b/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md @@ -115,8 +115,8 @@ This analytic is to look for suspicious command lines that may add entry to /etc #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_nopasswd_entry_in_sudoers_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md index 70cb99b0bc..a5ce53de0b 100644 --- a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md +++ b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md @@ -115,8 +115,8 @@ This analytic looks for suspicious chmod utility execution to enable SUID bit. T #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_setuid_using_chmod_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md index f532a50a5d..3f84cbaeda 100644 --- a/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md +++ b/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md @@ -115,8 +115,8 @@ This analytic looks for suspicious setcap utility execution to enable SUID bit. #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_setuid_using_setcap_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-21-linux_visudo_utility_execution.md b/docs/_posts/2021-12-21-linux_visudo_utility_execution.md index 814ef3f322..3116da0cc8 100644 --- a/docs/_posts/2021-12-21-linux_visudo_utility_execution.md +++ b/docs/_posts/2021-12-21-linux_visudo_utility_execution.md @@ -115,8 +115,8 @@ This analytic is to looks for suspicious commandline that add entry to /etc/sudo #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_visudo_utility_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md b/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md index 66b34d739a..e756d513a2 100644 --- a/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md +++ b/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md @@ -115,8 +115,8 @@ This analytic looks for suspicious file creation in kernel/driver directory in l #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_file_created_in_kernel_driver_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md b/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md index 94a25b61c5..b2488c3634 100644 --- a/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md +++ b/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md @@ -115,8 +115,8 @@ This analytic looks for inserting of linux kernel module using insmod utility fu #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_insert_kernel_module_using_insmod_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md b/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md index b251fd4fae..7f68a84eeb 100644 --- a/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md +++ b/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md @@ -115,8 +115,8 @@ This analytic looks for possible installing a linux kernel module using modprobe #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_install_kernel_module_using_modprobe_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md b/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md index 8634937703..ecf91245bd 100644 --- a/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md +++ b/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md @@ -117,8 +117,8 @@ This analytic is to detect a suspicious command that may hijack a library functi #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_preload_hijack_library_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md b/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md index e41cc28923..c58ac363d4 100644 --- a/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md +++ b/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md @@ -115,8 +115,8 @@ This analytic is to look for possible elevation control access using a common kn #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_common_process_for_elevation_control_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md b/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md index 61633cc0b9..0087e4ed82 100644 --- a/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md +++ b/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md @@ -115,8 +115,8 @@ This analytic is to looks for file creation of sudoers.tmp file cause by editing #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_sudoers_tmp_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md b/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md index cdb6c7fd4b..339e2ffa54 100644 --- a/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md +++ b/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md @@ -115,8 +115,8 @@ This analytic is to detect the execution of sudo or su command in linux operatin #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_sudo_or_su_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md b/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md index d5b3d92b20..9eb88bf61d 100644 --- a/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md +++ b/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md @@ -115,8 +115,8 @@ This analytic is to detect the creation of doas.conf file in linux host platform #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_doas_conf_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-05-linux_doas_tool_execution.md b/docs/_posts/2022-01-05-linux_doas_tool_execution.md index 2de453899f..a322917bc6 100644 --- a/docs/_posts/2022-01-05-linux_doas_tool_execution.md +++ b/docs/_posts/2022-01-05-linux_doas_tool_execution.md @@ -115,8 +115,8 @@ This analytic is to detect the doas tool execution in linux host platform. This #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_doas_tool_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md b/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md index 2aa11354c6..9050778c1c 100644 --- a/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md +++ b/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md @@ -113,8 +113,8 @@ This analytic is to detect a possible attempt to dump or access the content of / #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_possible_access_to_credential_files_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md b/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md index ccd0161f40..7a328f51ca 100644 --- a/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md +++ b/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md @@ -115,8 +115,8 @@ This analytic is to detect a possible access or modification of /etc/sudoers fil #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_possible_access_to_sudoers_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md b/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md index 7a3d71fcb8..3116f02ed4 100644 --- a/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md +++ b/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md @@ -113,8 +113,8 @@ This analytic is to look for suspicious process command-line that might be acces #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_possible_access_or_modification_of_sshd_config_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md b/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md index e48b498599..ee96e8edd4 100644 --- a/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md +++ b/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md @@ -113,8 +113,8 @@ This analytic is to look for possible ssh key file creation on ~/.ssh/ folder. T #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_possible_ssh_key_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md index 442e364455..5b55936c2f 100644 --- a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md +++ b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md @@ -126,9 +126,9 @@ The following hunting analytic identifies PowerShell commands utilizing the Wind #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **powershell_-_connect_to_internet_with_hidden_window_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md index 1ba88bee28..ad24135863 100644 --- a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md +++ b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md @@ -108,9 +108,9 @@ The following analytic uses a pretrained machine learning text classifier to det #### Macros The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [potentially_malicious_code_on_cmdline_tokenize_score](https://github.com/splunk/security_content/blob/develop/macros/potentially_malicious_code_on_cmdline_tokenize_score.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **potentially_malicious_code_on_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md index 7cf91e628e..65de741ab3 100644 --- a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md +++ b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md @@ -112,9 +112,9 @@ The following analytic identifies command-line arguments where `cmd.exe /c` is u #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **cmd_carry_out_string_command_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md b/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md index b88cdfc67f..202b1b4442 100644 --- a/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md +++ b/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md @@ -123,8 +123,8 @@ This analytic looks for the presence of suspicious commandline parameters typica #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **impacket_lateral_movement_commandline_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md index 799ee11de7..383cc57008 100644 --- a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md +++ b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md @@ -119,9 +119,9 @@ Alternatively, may use regex per matching here https://regexr.com/662ov. #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **malicious_powershell_process_-_encoded_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md b/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md index a5c900d7f4..79d72396a3 100644 --- a/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md +++ b/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md @@ -112,8 +112,8 @@ This analytic will identify a suspicious PowerShell command used to delete the W #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_remove_windows_defender_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md index 57a706f4f6..1ce9a54f4f 100644 --- a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md +++ b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md @@ -119,8 +119,8 @@ The following analytic identifies native .net binaries within the Windows operat #### Macros The SPL above uses the following Macros: * [is_net_windows_file](https://github.com/splunk/security_content/blob/develop/macros/is_net_windows_file.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_dotnet_binary_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md index 921bf0c555..14da8b3f81 100644 --- a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md +++ b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md @@ -118,8 +118,8 @@ The following analytic identifies the Windows binary InstallUtil.exe running fro #### Macros The SPL above uses the following Macros: * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_installutil_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-20-ping_sleep_batch_command.md b/docs/_posts/2022-01-20-ping_sleep_batch_command.md index 343ee79b70..24d910afbf 100644 --- a/docs/_posts/2022-01-20-ping_sleep_batch_command.md +++ b/docs/_posts/2022-01-20-ping_sleep_batch_command.md @@ -115,9 +115,9 @@ This analytic will identify the possible execution of ping sleep batch commands. #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_ping](https://github.com/splunk/security_content/blob/develop/macros/process_ping.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **ping_sleep_batch_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md b/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md index 3abf7bcc8b..63f965312e 100644 --- a/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md +++ b/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md @@ -102,8 +102,8 @@ The following analytic identifies the use of AdvancedRun.exe. AdvancedRun.exe ha #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_nirsoft_advancedrun_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md index 5784a8b047..5a80b1df2e 100644 --- a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md +++ b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md @@ -103,9 +103,9 @@ The following hunting analytic assists with identifying the proces execution of #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [is_nirsoft_software](https://github.com/splunk/security_content/blob/develop/macros/is_nirsoft_software.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_nirsoft_utilities_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md b/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md index 172fb5e898..26e45f6eac 100644 --- a/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md +++ b/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md @@ -121,8 +121,8 @@ This correlation find exploitation of Log4Shell CVE-2021-44228 against systems u #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **log4shell_cve-2021-44228_exploitation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md b/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md index 73f2bb9494..b4d42dcb83 100644 --- a/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md +++ b/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md @@ -108,8 +108,8 @@ The following analytic identifies `pkexec` spawning with no command-line argumen #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_pkexec_privilege_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md b/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md index 373aab455c..ea2831e11f 100644 --- a/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md +++ b/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md @@ -109,8 +109,8 @@ The following analytic looks for the use of Mimikatz command line parameters lev #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **mimikatz_passtheticket_commandline_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-01-rubeus_command_line_parameters.md b/docs/_posts/2022-02-01-rubeus_command_line_parameters.md index db02fcdfb6..1569f59492 100644 --- a/docs/_posts/2022-02-01-rubeus_command_line_parameters.md +++ b/docs/_posts/2022-02-01-rubeus_command_line_parameters.md @@ -124,8 +124,8 @@ Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily ad #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **rubeus_command_line_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md index b5b9d1279f..5baa3b5d90 100644 --- a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md +++ b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md @@ -102,9 +102,9 @@ Certutil.exe may download a file from a remote destination using `-urlcache`. Th #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **certutil_download_with_urlcache_and_split_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md index ccb7fb58d6..12ab6d2b16 100644 --- a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md +++ b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md @@ -102,9 +102,9 @@ Certutil.exe may download a file from a remote destination using `-VerifyCtl`. T #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **certutil_download_with_verifyctl_and_split_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md index 50d97d6377..750df54c18 100644 --- a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md +++ b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md @@ -103,9 +103,9 @@ The following analytic identifies the use of Microsoft Remote Assistance, msra.e #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_remote_assistance_spawning_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md index 5f804c74bc..7722585244 100644 --- a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md +++ b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md @@ -111,9 +111,9 @@ The following analytic identifies Schtasks.exe creating a new task to start and #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_schtasks](https://github.com/splunk/security_content/blob/develop/macros/process_schtasks.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_schtasks_create_run_as_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md index fdd002a3da..1ca1e1d4f7 100644 --- a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md +++ b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md @@ -114,8 +114,8 @@ The following analytic identifies rundll32.exe loading an export function by ord #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **rundll_loading_dll_by_ordinal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-14-linux_dd_file_overwrite.md b/docs/_posts/2022-02-14-linux_dd_file_overwrite.md index f986444057..0cfb7e786f 100644 --- a/docs/_posts/2022-02-14-linux_dd_file_overwrite.md +++ b/docs/_posts/2022-02-14-linux_dd_file_overwrite.md @@ -108,8 +108,8 @@ This analytic is to look for dd command to overwrite file. This technique was ab #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_dd_file_overwrite_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md index 08a81b3c4c..1ca1eaee9e 100644 --- a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md +++ b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md @@ -107,8 +107,8 @@ DiskShadow.exe is a Microsoft Signed binary present on Windows Server. It has a #### Macros The SPL above uses the following Macros: * [process_diskshadow](https://github.com/splunk/security_content/blob/develop/macros/process_diskshadow.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_diskshadow_proxy_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md b/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md index 8d5900fd32..bba5c4564b 100644 --- a/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md +++ b/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md @@ -114,8 +114,8 @@ The following analytic identifies the Windows Windows Remote Auto Dialer, rasaut #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_rasautou_dll_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md b/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md index 22d141bf26..3c247d1e0f 100644 --- a/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md +++ b/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **disabled_kerberos_pre-authentication_discovery_with_powerview_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-net_profiler_uac_bypass.md b/docs/_posts/2022-02-18-net_profiler_uac_bypass.md index 4ee6ea7a4a..1cf612c716 100644 --- a/docs/_posts/2022-02-18-net_profiler_uac_bypass.md +++ b/docs/_posts/2022-02-18-net_profiler_uac_bypass.md @@ -109,8 +109,8 @@ This search is to detect modification of registry to bypass UAC windows feature. #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **net_profiler_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md b/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md index f9ccc2a3bb..13c28723df 100644 --- a/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md +++ b/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md @@ -113,8 +113,8 @@ Monitor for changes of the ExecutionPolicy in the registry to the values "unrest #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md b/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md index 60219a7987..2b99704f67 100644 --- a/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md +++ b/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **disabled_kerberos_pre-authentication_discovery_with_get-aduser_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md b/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md index fd63b65fa0..8c5011facc 100644 --- a/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md +++ b/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md @@ -115,8 +115,8 @@ The following analytic identifies the creation or deletion of a scheduled task u #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **scheduled_task_deleted_or_created_via_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md index eaff2cd6b9..96eedbf53b 100644 --- a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md +++ b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md @@ -109,8 +109,8 @@ This analytic is to look for wmi commandlines to execute or create process. This #### Macros The SPL above uses the following Macros: * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_wmi_process_call_create_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md b/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md index 46b18ec802..0fa7e197b5 100644 --- a/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md +++ b/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md @@ -113,8 +113,8 @@ This analytic will identify suspicious excessive number of system events of serv #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_excessive_disabled_services_event_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md b/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md index ac188f0ae5..e336a11827 100644 --- a/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md +++ b/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md @@ -109,8 +109,8 @@ This analytic is to look for process commandline that contains named pipe. This #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_process_with_namedpipe_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md b/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md index 87dfcd6ea1..7c5c0a2b02 100644 --- a/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md +++ b/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md @@ -114,8 +114,8 @@ This analytic is to look for suspicious file creation in the critical folder lik #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_file_without_extension_in_critical_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md b/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md index 574b009b8e..74b80bc8eb 100644 --- a/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md +++ b/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md @@ -103,8 +103,8 @@ This analytic will identify suspicious series of process executions. We have ob #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **excessive_distinct_processes_from_windows_temp_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-08-suspicious_msbuild_path.md b/docs/_posts/2022-03-08-suspicious_msbuild_path.md index 2f99e22370..f3a0b01783 100644 --- a/docs/_posts/2022-03-08-suspicious_msbuild_path.md +++ b/docs/_posts/2022-03-08-suspicious_msbuild_path.md @@ -122,9 +122,9 @@ The following analytic identifies msbuild.exe executing from a non-standard path #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_msbuild_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md b/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md index f693985285..ccc0b8dbdc 100644 --- a/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md +++ b/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md @@ -108,8 +108,8 @@ The following analytic identifies a process performing an outbound connection on #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **unknown_process_using_the_kerberos_protocol_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md index a34980db99..da8370397f 100644 --- a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md @@ -113,9 +113,9 @@ The following analytic identifies regasm.exe with no command line arguments. Thi #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_regasm](https://github.com/splunk/security_content/blob/develop/macros/process_regasm.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_regasm_with_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md index 7451a3e1bf..a4972826ff 100644 --- a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md @@ -113,9 +113,9 @@ The following analytic identifies regsvcs.exe with no command line arguments. Th #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_regsvcs](https://github.com/splunk/security_content/blob/develop/macros/process_regsvcs.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_regsvcs](https://github.com/splunk/security_content/blob/develop/macros/process_regsvcs.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_regsvcs_with_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md index 2706545141..ffbc1a4619 100644 --- a/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md +++ b/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md @@ -109,8 +109,8 @@ The following analytic identifies DLLHost.exe with no command line arguments wit #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **dllhost_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md index 8b321bdcbb..fbbfcbeb5a 100644 --- a/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md +++ b/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md @@ -109,8 +109,8 @@ The following analytic identifies gpupdate.exe with no command line arguments an #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **gpupdate_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md index 7423684416..4c780c3d97 100644 --- a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md +++ b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md @@ -119,8 +119,8 @@ The following analytic identifies rundll32.exe with no command line arguments an #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **rundll32_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md b/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md index 324e1c458c..5c333ca65b 100644 --- a/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md +++ b/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md @@ -109,8 +109,8 @@ The following analytic identifies searchprotocolhost.exe with no command line ar #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **searchprotocolhost_with_no_command_line_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md index 3a31fcf9ff..c5fb8b3ffa 100644 --- a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md @@ -104,9 +104,9 @@ The following analytic identifies DLLHost.exe with no command line arguments. It #### Macros The SPL above uses the following Macros: -* [process_dllhost](https://github.com/splunk/security_content/blob/develop/macros/process_dllhost.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_dllhost](https://github.com/splunk/security_content/blob/develop/macros/process_dllhost.yml) > :information_source: > **suspicious_dllhost_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md index 006012ac4d..844a893453 100644 --- a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md @@ -104,9 +104,9 @@ The following analytic identifies gpupdate.exe with no command line arguments. I #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_gpupdate](https://github.com/splunk/security_content/blob/develop/macros/process_gpupdate.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_gpupdate_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md index 5dc93741a3..3805e9254b 100644 --- a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md @@ -119,8 +119,8 @@ The following analytic identifies rundll32.exe with no command line arguments. I #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_rundll32_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md index d943755167..6c75b14d70 100644 --- a/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md @@ -104,8 +104,8 @@ The following analytic identifies searchprotocolhost.exe with no command line ar #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_searchprotocolhost_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md index 02546a0eed..f012129af1 100644 --- a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md +++ b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md @@ -116,8 +116,8 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_installutil_remote_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md index 4eba7529a2..5204d6ee21 100644 --- a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md +++ b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md @@ -117,8 +117,8 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_installutil_uninstall_option_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md b/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md index 68b0b97869..248502084b 100644 --- a/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md +++ b/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md @@ -102,8 +102,8 @@ This analytic identifies suspicious modification of ACL permission to a files or #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **modify_acl_permission_to_files_or_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2022-03-22-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md index b92d9ede9a..74f5f965b3 100644 --- a/docs/_posts/2022-03-22-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md @@ -100,8 +100,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-get_domainuser_with_powershell_script_block.md b/docs/_posts/2022-03-22-get_domainuser_with_powershell_script_block.md index 6537929b66..da5c5a0d7a 100644 --- a/docs/_posts/2022-03-22-get_domainuser_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-get_domainuser_with_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **get_domainuser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-get_wmiobject_group_discovery_with_script_block_logging.md b/docs/_posts/2022-03-22-get_wmiobject_group_discovery_with_script_block_logging.md index bc2cd769f7..3b0d03259d 100644 --- a/docs/_posts/2022-03-22-get_wmiobject_group_discovery_with_script_block_logging.md +++ b/docs/_posts/2022-03-22-get_wmiobject_group_discovery_with_script_block_logging.md @@ -107,8 +107,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **get_wmiobject_group_discovery_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-getadgroup_with_powershell_script_block.md b/docs/_posts/2022-03-22-getadgroup_with_powershell_script_block.md index 2f98054adc..d41c63b039 100644 --- a/docs/_posts/2022-03-22-getadgroup_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-getadgroup_with_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getadgroup_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-getcurrent_user_with_powershell_script_block.md b/docs/_posts/2022-03-22-getcurrent_user_with_powershell_script_block.md index a17ba7e26e..7360d8b806 100644 --- a/docs/_posts/2022-03-22-getcurrent_user_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-getcurrent_user_with_powershell_script_block.md @@ -100,8 +100,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getcurrent_user_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md b/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md index 852b9be36e..fce94f7e8c 100644 --- a/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **getlocaluser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-interactive_session_on_remote_endpoint_with_powershell.md b/docs/_posts/2022-03-22-interactive_session_on_remote_endpoint_with_powershell.md index 6b739035e2..794c52a432 100644 --- a/docs/_posts/2022-03-22-interactive_session_on_remote_endpoint_with_powershell.md +++ b/docs/_posts/2022-03-22-interactive_session_on_remote_endpoint_with_powershell.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **interactive_session_on_remote_endpoint_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-kerberos_pre-authentication_flag_disabled_with_powershell.md b/docs/_posts/2022-03-22-kerberos_pre-authentication_flag_disabled_with_powershell.md index ae8a733c0f..1dbda3af81 100644 --- a/docs/_posts/2022-03-22-kerberos_pre-authentication_flag_disabled_with_powershell.md +++ b/docs/_posts/2022-03-22-kerberos_pre-authentication_flag_disabled_with_powershell.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **kerberos_pre-authentication_flag_disabled_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-powershell_execute_com_object.md b/docs/_posts/2022-03-22-powershell_execute_com_object.md index 812e504e80..18ed9ef03a 100644 --- a/docs/_posts/2022-03-22-powershell_execute_com_object.md +++ b/docs/_posts/2022-03-22-powershell_execute_com_object.md @@ -108,8 +108,8 @@ This search is to detect a COM CLSID execution through powershell. This techniqu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_execute_com_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md b/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md index f1e1f53671..86b61d0868 100644 --- a/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md +++ b/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md @@ -105,8 +105,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_using_memory_as_backing_store_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md b/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md index 4b2f95e35b..41ca8c1dbb 100644 --- a/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md +++ b/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md @@ -100,8 +100,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **recon_avproduct_through_pwh_or_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-remote_process_instantiation_via_dcom_and_powershell_script_block.md b/docs/_posts/2022-03-22-remote_process_instantiation_via_dcom_and_powershell_script_block.md index d1a7fe8c0b..669000fd6a 100644 --- a/docs/_posts/2022-03-22-remote_process_instantiation_via_dcom_and_powershell_script_block.md +++ b/docs/_posts/2022-03-22-remote_process_instantiation_via_dcom_and_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **remote_process_instantiation_via_dcom_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md b/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md index b98a1b1544..e285770d5e 100644 --- a/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md +++ b/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **remote_process_instantiation_via_winrm_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-user_discovery_with_env_vars_powershell_script_block.md b/docs/_posts/2022-03-22-user_discovery_with_env_vars_powershell_script_block.md index b3eca55344..c4cca2d7ac 100644 --- a/docs/_posts/2022-03-22-user_discovery_with_env_vars_powershell_script_block.md +++ b/docs/_posts/2022-03-22-user_discovery_with_env_vars_powershell_script_block.md @@ -100,8 +100,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **user_discovery_with_env_vars_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-28-windows_get-adcomputer_unconstrained_delegation_discovery.md b/docs/_posts/2022-03-28-windows_get-adcomputer_unconstrained_delegation_discovery.md index a3aedd0f60..5b961d19a5 100644 --- a/docs/_posts/2022-03-28-windows_get-adcomputer_unconstrained_delegation_discovery.md +++ b/docs/_posts/2022-03-28-windows_get-adcomputer_unconstrained_delegation_discovery.md @@ -106,8 +106,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_get-adcomputer_unconstrained_delegation_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-28-windows_powerview_unconstrained_delegation_discovery.md b/docs/_posts/2022-03-28-windows_powerview_unconstrained_delegation_discovery.md index bf1b12c71f..3864819c70 100644 --- a/docs/_posts/2022-03-28-windows_powerview_unconstrained_delegation_discovery.md +++ b/docs/_posts/2022-03-28-windows_powerview_unconstrained_delegation_discovery.md @@ -106,8 +106,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_powerview_unconstrained_delegation_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md b/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md index 9ae2aae28d..d6a31df127 100644 --- a/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md +++ b/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md @@ -123,8 +123,8 @@ The following analytic identifies the use of a delivered ISO file that has been #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_iso_lnk_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-31-windows_powerview_constrained_delegation_discovery.md b/docs/_posts/2022-03-31-windows_powerview_constrained_delegation_discovery.md index 55aa0881cd..7273292702 100644 --- a/docs/_posts/2022-03-31-windows_powerview_constrained_delegation_discovery.md +++ b/docs/_posts/2022-03-31-windows_powerview_constrained_delegation_discovery.md @@ -106,8 +106,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_powerview_constrained_delegation_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md b/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md index cb85c01f90..008e97ef0a 100644 --- a/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md +++ b/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md @@ -113,8 +113,8 @@ This search detects a disabled security workflow in GitHub Actions. An attacker #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **github_actions_disable_security_workflow_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md b/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md index e8bf097fdc..a49622fd78 100644 --- a/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md +++ b/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md @@ -107,8 +107,8 @@ The following analytic uses Windows EventCode 7045 to identify new Kernel Mode D #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_driver_load_non-standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-04-windows_event_for_service_disabled.md b/docs/_posts/2022-04-04-windows_event_for_service_disabled.md index 5d7224b035..ba8933f81a 100644 --- a/docs/_posts/2022-04-04-windows_event_for_service_disabled.md +++ b/docs/_posts/2022-04-04-windows_event_for_service_disabled.md @@ -112,8 +112,8 @@ This analytic will identify suspicious system event of services that was modifie #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_event_for_service_disabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md b/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md index 16035560b4..20a44c84b6 100644 --- a/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md +++ b/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md @@ -115,8 +115,8 @@ This analytic looks for suspicious commandline that redirect the stdout or possi #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_stdout_redirection_to_dev_null_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md index acd9989556..0393e4c84c 100644 --- a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md +++ b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md @@ -107,8 +107,8 @@ The following analytic detects programs that have been started by forfiles.exe. #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_indirect_command_execution_via_forfiles_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md index f7e1be5907..89de9e7418 100644 --- a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md +++ b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md @@ -107,8 +107,8 @@ The following analytic detects programs that have been started by pcalua.exe. pc #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_indirect_command_execution_via_pcalua_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md b/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md index aa65234c4a..d73eeffe74 100644 --- a/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md +++ b/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md @@ -113,8 +113,8 @@ The following analytic identifies the payload related to Spring4Shell, CVE-2022- #### Macros The SPL above uses the following Macros: -* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) > :information_source: > **web_spring4shell_http_request_class_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-any_powershell_downloadfile.md b/docs/_posts/2022-04-07-any_powershell_downloadfile.md index 65acb4e0a0..65e39d055c 100644 --- a/docs/_posts/2022-04-07-any_powershell_downloadfile.md +++ b/docs/_posts/2022-04-07-any_powershell_downloadfile.md @@ -117,9 +117,9 @@ The following analytic identifies the use of PowerShell downloading a file using #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **any_powershell_downloadfile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-any_powershell_downloadstring.md b/docs/_posts/2022-04-07-any_powershell_downloadstring.md index 6f2c3f2caa..d7ba5d5cc3 100644 --- a/docs/_posts/2022-04-07-any_powershell_downloadstring.md +++ b/docs/_posts/2022-04-07-any_powershell_downloadstring.md @@ -112,9 +112,9 @@ The following analytic identifies the use of PowerShell downloading a file using #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **any_powershell_downloadstring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-detect_html_help_renamed.md b/docs/_posts/2022-04-07-detect_html_help_renamed.md index 2c83977abd..6acb966621 100644 --- a/docs/_posts/2022-04-07-detect_html_help_renamed.md +++ b/docs/_posts/2022-04-07-detect_html_help_renamed.md @@ -112,8 +112,8 @@ The following analytic identifies a renamed instance of hh.exe (HTML Help) execu #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_html_help_renamed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-detect_mshta_renamed.md b/docs/_posts/2022-04-07-detect_mshta_renamed.md index bd17b43c17..6c7bb3deb7 100644 --- a/docs/_posts/2022-04-07-detect_mshta_renamed.md +++ b/docs/_posts/2022-04-07-detect_mshta_renamed.md @@ -112,8 +112,8 @@ The following analytic identifies renamed instances of mshta.exe executing. Msht #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_mshta_renamed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-detect_renamed_psexec.md b/docs/_posts/2022-04-07-detect_renamed_psexec.md index e8daa0b410..db349684ac 100644 --- a/docs/_posts/2022-04-07-detect_renamed_psexec.md +++ b/docs/_posts/2022-04-07-detect_renamed_psexec.md @@ -107,8 +107,8 @@ The following analytic identifies renamed instances of `PsExec.exe` being utiliz #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_renamed_psexec_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md b/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md index 6787b99a3d..8a944454e2 100644 --- a/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md +++ b/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md @@ -117,8 +117,8 @@ The following analytic identifies a renamed instance of microsoft.workflow.compi #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_microsoft_workflow_compiler_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-suspicious_msbuild_rename.md b/docs/_posts/2022-04-07-suspicious_msbuild_rename.md index 65148f9078..c2a68c2137 100644 --- a/docs/_posts/2022-04-07-suspicious_msbuild_rename.md +++ b/docs/_posts/2022-04-07-suspicious_msbuild_rename.md @@ -122,8 +122,8 @@ The following analytic identifies renamed instances of msbuild.exe executing. Ms #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_msbuild_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-suspicious_rundll32_rename.md b/docs/_posts/2022-04-07-suspicious_rundll32_rename.md index 07abd6388f..ac99111818 100644 --- a/docs/_posts/2022-04-07-suspicious_rundll32_rename.md +++ b/docs/_posts/2022-04-07-suspicious_rundll32_rename.md @@ -122,8 +122,8 @@ The following hunting analytic identifies renamed instances of rundll32.exe exec #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_rundll32_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md b/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md index 886e74fc2b..12f96affcf 100644 --- a/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md +++ b/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md @@ -115,8 +115,8 @@ The following analytic identifies a process attempting to delete a scheduled tas #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_registry_delete_task_sd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md b/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md index 61b922223d..3ca6c97894 100644 --- a/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md +++ b/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md @@ -107,9 +107,9 @@ This search looks for the execution of `nltest.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_nltest](https://github.com/splunk/security_content/blob/develop/macros/process_nltest.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **nltest_domain_trust_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-22-linux_adding_crontab_using_list_parameter.md b/docs/_posts/2022-04-22-linux_adding_crontab_using_list_parameter.md index 0d89850005..c2a8c673ef 100644 --- a/docs/_posts/2022-04-22-linux_adding_crontab_using_list_parameter.md +++ b/docs/_posts/2022-04-22-linux_adding_crontab_using_list_parameter.md @@ -117,8 +117,8 @@ The following analytic identifies a suspicious cron jobs modification using cron #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_adding_crontab_using_list_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-22-linux_deleting_critical_directory_using_rm_command.md b/docs/_posts/2022-04-22-linux_deleting_critical_directory_using_rm_command.md index 7df59fa8ee..f5f77d7472 100644 --- a/docs/_posts/2022-04-22-linux_deleting_critical_directory_using_rm_command.md +++ b/docs/_posts/2022-04-22-linux_deleting_critical_directory_using_rm_command.md @@ -108,8 +108,8 @@ The following analytic identifies a suspicious deletion of a critical folder in #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_deleting_critical_directory_using_rm_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-22-linux_disable_services.md b/docs/_posts/2022-04-22-linux_disable_services.md index 511db970ed..d099ecf726 100644 --- a/docs/_posts/2022-04-22-linux_disable_services.md +++ b/docs/_posts/2022-04-22-linux_disable_services.md @@ -108,8 +108,8 @@ The following analytic is to detect events that attempts to disable a service. T #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_disable_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-22-linux_shred_overwrite_command.md b/docs/_posts/2022-04-22-linux_shred_overwrite_command.md index c0e42b6493..f1c6a95dc1 100644 --- a/docs/_posts/2022-04-22-linux_shred_overwrite_command.md +++ b/docs/_posts/2022-04-22-linux_shred_overwrite_command.md @@ -108,8 +108,8 @@ This analytic is to detect a shred process to overwrite a files in a linux machi #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_shred_overwrite_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-22-linux_stop_services.md b/docs/_posts/2022-04-22-linux_stop_services.md index 9c2404013c..f9ba9a7b71 100644 --- a/docs/_posts/2022-04-22-linux_stop_services.md +++ b/docs/_posts/2022-04-22-linux_stop_services.md @@ -108,8 +108,8 @@ The following analytic is to detect events that attempt to stop or clear a servi #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_stop_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-25-windows_linked_policies_in_adsi_discovery.md b/docs/_posts/2022-04-25-windows_linked_policies_in_adsi_discovery.md index 70fa0e4f3f..34af68501f 100644 --- a/docs/_posts/2022-04-25-windows_linked_policies_in_adsi_discovery.md +++ b/docs/_posts/2022-04-25-windows_linked_policies_in_adsi_discovery.md @@ -112,8 +112,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_linked_policies_in_adsi_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-25-windows_root_domain_linked_policies_discovery.md b/docs/_posts/2022-04-25-windows_root_domain_linked_policies_discovery.md index dc17c69bb6..db7c76d204 100644 --- a/docs/_posts/2022-04-25-windows_root_domain_linked_policies_discovery.md +++ b/docs/_posts/2022-04-25-windows_root_domain_linked_policies_discovery.md @@ -112,8 +112,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_root_domain_linked_policies_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-29-path_traversal_spl_injection.md b/docs/_posts/2022-04-29-path_traversal_spl_injection.md index f957c548be..a5fb373842 100644 --- a/docs/_posts/2022-04-29-path_traversal_spl_injection.md +++ b/docs/_posts/2022-04-29-path_traversal_spl_injection.md @@ -90,7 +90,7 @@ On May 3rd, 2022, Splunk published a security advisory for a Path traversal in s
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [CVE-2022-26889](https://nvd.nist.gov/vuln/detail/CVE-2022-26889) | The lack of sanitization in a relative url path in a search parameter allows for arbitrary injection of external content in Splunk Enterprise versions before 8.1.2. | 5.1 | +| [CVE-2022-26889](https://nvd.nist.gov/vuln/detail/CVE-2022-26889) | In Splunk Enterprise versions before 8.1.2, the uri path to load a relative resource within a web page is vulnerable to path traversal. It allows an attacker to potentially inject arbitrary content into the web page (e.g., HTML Injection, XSS) or bypass SPL safeguards for risky commands. The attack is browser-based. An attacker cannot exploit the attack at will and requires the attacker to initiate a request within the victim's browser (e.g., phishing). | 5.1 | diff --git a/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md b/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md index 6a402c09d2..81557141a0 100644 --- a/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md +++ b/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md @@ -113,8 +113,8 @@ This analytic looks for suspicious process kworker commandline in a linux machin #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_kworker_process_in_writable_process_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md b/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md index 197ec18a1a..50bd382f02 100644 --- a/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md +++ b/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md @@ -108,8 +108,8 @@ The following analytic identifies the default service name created by KrbRelayUp #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_krbrelayup_service_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-05-windows_service_create_kernel_mode_driver.md b/docs/_posts/2022-05-05-windows_service_create_kernel_mode_driver.md index f52fd0bab9..7127c9061b 100644 --- a/docs/_posts/2022-05-05-windows_service_create_kernel_mode_driver.md +++ b/docs/_posts/2022-05-05-windows_service_create_kernel_mode_driver.md @@ -120,8 +120,8 @@ The following analytic identifes a new kernel driver being added to Windows usin #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_service_create_kernel_mode_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-16-windows_system_file_on_disk.md b/docs/_posts/2022-05-16-windows_system_file_on_disk.md index 10dde422ad..a4469a0c63 100644 --- a/docs/_posts/2022-05-16-windows_system_file_on_disk.md +++ b/docs/_posts/2022-05-16-windows_system_file_on_disk.md @@ -108,8 +108,8 @@ The following hunting analytic will assist with identifying new .sys files intro #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_system_file_on_disk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-23-schtasks_scheduling_job_on_remote_system.md b/docs/_posts/2022-05-23-schtasks_scheduling_job_on_remote_system.md index e14e37df10..faa65f5472 100644 --- a/docs/_posts/2022-05-23-schtasks_scheduling_job_on_remote_system.md +++ b/docs/_posts/2022-05-23-schtasks_scheduling_job_on_remote_system.md @@ -115,8 +115,8 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **schtasks_scheduling_job_on_remote_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-26-linux_at_application_execution.md b/docs/_posts/2022-05-26-linux_at_application_execution.md index d4d3ae7e0d..6ab7c3618b 100644 --- a/docs/_posts/2022-05-26-linux_at_application_execution.md +++ b/docs/_posts/2022-05-26-linux_at_application_execution.md @@ -117,8 +117,8 @@ The following analytic identifies a suspicious process creation of At applicatio #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_at_application_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-26-linux_possible_append_command_to_at_allow_config_file.md b/docs/_posts/2022-05-26-linux_possible_append_command_to_at_allow_config_file.md index 225f6cd674..460b2cc15f 100644 --- a/docs/_posts/2022-05-26-linux_possible_append_command_to_at_allow_config_file.md +++ b/docs/_posts/2022-05-26-linux_possible_append_command_to_at_allow_config_file.md @@ -117,8 +117,8 @@ This analytic looks for suspicious commandline that may use to append user entry #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **linux_possible_append_command_to_at_allow_config_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-30-windows_execute_arbitrary_commands_with_msdt.md b/docs/_posts/2022-05-30-windows_execute_arbitrary_commands_with_msdt.md index abbd61b6f5..070bc31954 100644 --- a/docs/_posts/2022-05-30-windows_execute_arbitrary_commands_with_msdt.md +++ b/docs/_posts/2022-05-30-windows_execute_arbitrary_commands_with_msdt.md @@ -1,6 +1,6 @@ --- title: "Windows Execute Arbitrary Commands with MSDT" -excerpt: "Indirect Command Execution +excerpt: "System Binary Proxy Execution " categories: - Endpoint @@ -8,12 +8,12 @@ last_modified_at: 2022-05-30 toc: true toc_label: "" tags: - - Indirect Command Execution + - System Binary Proxy Execution - Defense Evasion - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - - + - CVE-2022-30190 - Endpoint --- @@ -43,7 +43,7 @@ The following analytic identifies a recently disclosed arbitraty command executi | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | -| [T1202](https://attack.mitre.org/techniques/T1202/) | Indirect Command Execution | Defense Evasion | +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion |
@@ -93,7 +93,7 @@ The following analytic identifies a recently disclosed arbitraty command executi
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [](https://nvd.nist.gov/vuln/detail/) | | | +| [CVE-2022-30190](https://nvd.nist.gov/vuln/detail/CVE-2022-30190) | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability. | 9.3 | @@ -104,17 +104,17 @@ The following analytic identifies a recently disclosed arbitraty command executi ``` -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msdt.exe Processes.process="*ms-msdt:/id*" Processes.process="*IT_BrowseForFile=*" Processes.process="*IT_RebrowseForFile=*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msdt.exe Processes.process IN ("*ms-msdt:/id*","*ms-msdt:-id*","*/id*") AND (Processes.process="*IT_BrowseForFile=*" OR Processes.process="*IT_RebrowseForFile=*" OR Processes.process="*.xml*") AND Processes.process="*PCWDiagnostic*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `windows_execute_arbitrary_commands_with_msdt_filter` ``` #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_execute_arbitrary_commands_with_msdt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -138,7 +138,7 @@ The SPL above uses the following Macros: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. #### Known False Positives -False positives may be present, filter as needed. +False positives may be present, filter as needed. Added .xml to potentially capture any answer file usage. Remove as needed. #### Associated Analytic story * [Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190](/stories/microsoft_support_diagnostic_tool_vulnerability_cve-2022-30190) @@ -176,4 +176,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith -[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml) \| *version*: **1** \ No newline at end of file +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2022-05-30-windows_office_product_spawning_msdt.md b/docs/_posts/2022-05-30-windows_office_product_spawning_msdt.md index 3be85ab734..d88c00db39 100644 --- a/docs/_posts/2022-05-30-windows_office_product_spawning_msdt.md +++ b/docs/_posts/2022-05-30-windows_office_product_spawning_msdt.md @@ -16,7 +16,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - - + - CVE-2022-30190 - Endpoint --- @@ -98,7 +98,7 @@ The following analytic identifies a Microsoft Office product spawning the Window
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | -| [](https://nvd.nist.gov/vuln/detail/) | | | +| [CVE-2022-30190](https://nvd.nist.gov/vuln/detail/CVE-2022-30190) | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability. | 9.3 | @@ -118,8 +118,8 @@ The following analytic identifies a Microsoft Office product spawning the Window #### Macros The SPL above uses the following Macros: -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **windows_office_product_spawning_msdt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-06-01-unload_sysmon_filter_driver.md b/docs/_posts/2022-06-01-unload_sysmon_filter_driver.md new file mode 100644 index 0000000000..4678bd2d68 --- /dev/null +++ b/docs/_posts/2022-06-01-unload_sysmon_filter_driver.md @@ -0,0 +1,168 @@ +--- +title: "Unload Sysmon Filter Driver" +excerpt: "Disable or Modify Tools +, Impair Defenses +" +categories: + - Endpoint +last_modified_at: 2022-06-01 +toc: true +toc_label: "" +tags: + - Disable or Modify Tools + - Impair Defenses + - Defense Evasion + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +Attackers often disable security tools to avoid detection. This search looks for the usage of process `fltMC.exe` to unload a Sysmon Driver that will stop sysmon from collecting the data. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Last Updated**: 2022-06-01 +- **Author**: Bhavin Patel, Splunk +- **ID**: e5928ff3-23eb-4d8b-b8a4-dcbc844fdfbe + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Actions on Objectives + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 8 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=fltMC.exe AND Processes.process=*unload* AND Processes.process=*SysmonDrv* by Processes.process_name Processes.process_id Processes.parent_process_name Processes.process Processes.dest Processes.user +| `drop_dm_object_name("Processes")` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +|`unload_sysmon_filter_driver_filter` +| table firstTime lastTime dest user count process_name process_id parent_process_name process +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +> :information_source: +> **unload_sysmon_filter_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_name +* Processes.dest +* Processes.user + + +#### How To Implement +You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. This search is also shipped with `unload_sysmon_filter_driver_filter` macro, update this macro to filter out false positives. + +#### Known False Positives +Unknown at the moment + +#### Associated Analytic story +* [Disabling Security Tools](/stories/disabling_security_tools) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 45.0 | 50 | 90 | Possible Sysmon filter driver unloading on $dest$ | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://www.ired.team/offensive-security/defense-evasion/unloading-sysmon-driver](https://www.ired.team/offensive-security/defense-evasion/unloading-sysmon-driver) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/unload_sysmon/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/unload_sysmon/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/unload_sysmon_filter_driver.yml) \| *version*: **4** \ No newline at end of file diff --git a/docs/_posts/2022-06-01-windows_command_and_scripting_interpreter_hunting_path_traversal.md b/docs/_posts/2022-06-01-windows_command_and_scripting_interpreter_hunting_path_traversal.md new file mode 100644 index 0000000000..45e5636f24 --- /dev/null +++ b/docs/_posts/2022-06-01-windows_command_and_scripting_interpreter_hunting_path_traversal.md @@ -0,0 +1,175 @@ +--- +title: "Windows Command and Scripting Interpreter Hunting Path Traversal" +excerpt: "Command and Scripting Interpreter +" +categories: + - Endpoint +last_modified_at: 2022-06-01 +toc: true +toc_label: "" +tags: + - Command and Scripting Interpreter + - Execution + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies path traversal command-line execution and should be used to tune and driver other more higher fidelity analytics. This technique was seen in malicious document that execute malicious code using msdt.exe and path traversal technique that serve as defense evasion. This Hunting query is a good pivot to look for possible suspicious process and command-line that runs execute path traversal technique to run malicious code. This may help you to find possible downloaded malware or other lolbin execution. + +- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-06-01 +- **Author**: Teoderick Contreras, Michael Haag, Splunk +- **ID**: d0026380-b3c4-4da0-ac8e-02790063ff6b + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process +| `drop_dm_object_name("Processes")` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| eval count_of_pattern1 = (mvcount(split(process,"/.."))-1) +| eval count_of_pattern2 = (mvcount(split(process,"\.."))-1) +| eval count_of_pattern3 = (mvcount(split(process,"\\.."))-1) +| eval count_of_pattern4 = (mvcount(split(process,"//.."))-1) +| search count_of_pattern1 > 1 OR count_of_pattern2 > 1 OR count_of_pattern3 > 1 OR count_of_pattern4 > 1 +| `windows_command_and_scripting_interpreter_hunting_path_traversal_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +> :information_source: +> **windows_command_and_scripting_interpreter_hunting_path_traversal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product + +#### Known False Positives +false positive may vary depends on the score you want to check. The bigger number of path traversal string count the better. + +#### Associated Analytic story +* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics) +* [Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190](/stories/microsoft_support_diagnostic_tool_vulnerability_cve-2022-30190) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 36.0 | 60 | 60 | A parent process $parent_process_name$ has spawned a child $process_name$ with path traversal commandline $process$ in $dest$ | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/](https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/path_traversal/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/path_traversal/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-06-01-windows_command_and_scripting_interpreter_path_traversal_exec.md b/docs/_posts/2022-06-01-windows_command_and_scripting_interpreter_path_traversal_exec.md new file mode 100644 index 0000000000..7d1376be5b --- /dev/null +++ b/docs/_posts/2022-06-01-windows_command_and_scripting_interpreter_path_traversal_exec.md @@ -0,0 +1,170 @@ +--- +title: "Windows Command and Scripting Interpreter Path Traversal Exec" +excerpt: "Command and Scripting Interpreter +" +categories: + - Endpoint +last_modified_at: 2022-06-01 +toc: true +toc_label: "" +tags: + - Command and Scripting Interpreter + - Execution + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies path traversal command-line execution. This technique was seen in malicious document that execute malicious code using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and command-line that runs before and after this execution. This may help you to find possible downloaded malware or other lolbin execution. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-06-01 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 58fcdeb1-728d-415d-b0d7-3ab18a275ec2 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process="*\/..\/..\/..\/*" OR Processes.process="*\\..\\..\\..\\*" OR Processes.process="*\/\/..\/\/..\/\/..\/\/*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash +| `drop_dm_object_name("Processes")` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `windows_command_and_scripting_interpreter_path_traversal_exec_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +> :information_source: +> **windows_command_and_scripting_interpreter_path_traversal_exec_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product + +#### Known False Positives +Not known at this moment. + +#### Associated Analytic story +* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics) +* [Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190](/stories/microsoft_support_diagnostic_tool_vulnerability_cve-2022-30190) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 90.0 | 90 | 100 | A parent process $parent_process_name$ has spawned a child $process_name$ with path traversal commandline $process$ in $dest$ | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/](https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/path_traversal/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/path_traversal/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2022-06-03-confluence_unauthenticated_remote_code_execution_cve-2022-26134.md b/docs/_posts/2022-06-03-confluence_unauthenticated_remote_code_execution_cve-2022-26134.md new file mode 100644 index 0000000000..de3e2d1ab2 --- /dev/null +++ b/docs/_posts/2022-06-03-confluence_unauthenticated_remote_code_execution_cve-2022-26134.md @@ -0,0 +1,176 @@ +--- +title: "Confluence Unauthenticated Remote Code Execution CVE-2022-26134" +excerpt: "Server Software Component +, Exploit Public-Facing Application +" +categories: + - Web +last_modified_at: 2022-06-03 +toc: true +toc_label: "" +tags: + - Server Software Component + - Exploit Public-Facing Application + - Persistence + - Initial Access + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - CVE-2022-26134 + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic assists with identifying CVE-2022-26134 based exploitation utilizing the Web datamodel to cover network and CIM compliant web logs. The parameters were captured from live scanning and the POC provided by Rapid7. This analytic is written against multiple proof of concept codes released and seen in the wild (scanning). During triage, review any endpoint based logs for further activity including writing a jsp file to disk and commands/processes spawning running as root from the Confluence process. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-06-03 +- **Author**: Michael Haag, Splunk +- **ID**: fcf4bd3f-a79f-4b7a-83bf-2692d60b859c + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1505](https://attack.mitre.org/techniques/T1505/) | Server Software Component | Persistence | + +| [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2022-26134](https://nvd.nist.gov/vuln/detail/CVE-2022-26134) | In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1. | None | + + + +
+
+ +#### Search + +``` + +| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("*${*", "*%2F%7B*") (Web.url="*org.apache.commons.io.IOUtils*" Web.url="*java.lang.Runtime@getRuntime().exec*") OR (Web.url="*java.lang.Runtime%40getRuntime%28%29.exec*") OR (Web.url="*getEngineByName*" AND Web.url="*nashorn*" AND Web.url="*ProcessBuilder*") by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest sourcetype +| `drop_dm_object_name("Web")` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `confluence_unauthenticated_remote_code_execution_cve_2022_26134_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) + +> :information_source: +> **confluence_unauthenticated_remote_code_execution_cve-2022-26134_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Web.http_method +* Web.url +* Web.url_length +* Web.src +* Web.dest +* Web.http_user_agent + + +#### How To Implement +This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache or Splunk for Nginx. In addition, network based logs or event data like PAN Threat. + +#### Known False Positives +Tune based on assets if possible, or restrict to known Confluence servers. Remove the ${ for a more broad query. To identify more exec, remove everything up to the last parameter (Runtime().exec) for a broad query. + +#### Associated Analytic story +* [Atlassian Confluence Server and Data Center CVE-2022-26134](/stories/atlassian_confluence_server_and_data_center_cve-2022-26134) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 100.0 | 100 | 100 | A URL was requested related to CVE-2022-26134, a unauthenticated remote code execution vulnerability, on $dest$ by $src$. | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html](https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html) +* [https://www.splunk.com/en_us/blog/security/atlassian-confluence-vulnerability-cve-2022-26134.html](https://www.splunk.com/en_us/blog/security/atlassian-confluence-vulnerability-cve-2022-26134.html) +* [https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/](https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/) +* [https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/](https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/java/confluence.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/java/confluence.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md b/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md new file mode 100644 index 0000000000..93e889596e --- /dev/null +++ b/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md @@ -0,0 +1,165 @@ +--- +title: "Excessive Usage of NSLOOKUP App" +excerpt: "Exfiltration Over Alternative Protocol +" +categories: + - Endpoint +last_modified_at: 2022-06-03 +toc: true +toc_label: "" +tags: + - Exfiltration Over Alternative Protocol + - Exfiltration + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +This search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-06-03 +- **Author**: Teoderick Contreras, Stanislav Miskovic, Splunk +- **ID**: 0a69fdaa-a2b8-11eb-b16d-acde48001122 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ + + +
+
+ +
+ CIS20 + +
+ + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` +`sysmon` EventCode = 1 process_name = "nslookup.exe" +| bucket _time span=1m +| stats count as numNsLookup by Computer, _time +| eventstats avg(numNsLookup) as avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer +| eval upperThreshold=(avgNsLookup + stdNsLookup *3) +| eval isOutlier=if(numNsLookup > 20 and numNsLookup >= upperThreshold, 1, 0) +| search isOutlier=1 +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `excessive_usage_of_nslookup_app_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) + +> :information_source: +> **excessive_usage_of_nslookup_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Computer +* process_name +* EventCode + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of nslookup.exe may be used. + +#### Known False Positives +unknown + +#### Associated Analytic story +* [Suspicious DNS Traffic](/stories/suspicious_dns_traffic) +* [Dynamic DNS](/stories/dynamic_dns) +* [Data Exfiltration](/stories/data_exfiltration) +* [Command and Control](/stories/command_and_control) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 28.0 | 40 | 70 | Excessive usage of nslookup.exe has been detected on $Computer$. This detection is triggered as as it violates the dynamic threshold | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html](https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html) +* [https://www.varonis.com/blog/dns-tunneling/](https://www.varonis.com/blog/dns-tunneling/) +* [https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/](https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/sysmon.log) +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/excessive_usage_of_nslookup_app.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2022-06-03-java_writing_jsp_file.md b/docs/_posts/2022-06-03-java_writing_jsp_file.md new file mode 100644 index 0000000000..2179360efe --- /dev/null +++ b/docs/_posts/2022-06-03-java_writing_jsp_file.md @@ -0,0 +1,188 @@ +--- +title: "Java Writing JSP File" +excerpt: "Exploit Public-Facing Application +" +categories: + - Endpoint +last_modified_at: 2022-06-03 +toc: true +toc_label: "" +tags: + - Exploit Public-Facing Application + - Initial Access + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - CVE-2022-22965 + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies the process java writing a .jsp to disk. This is potentially indicative of a web shell being written to disk. Modify and tune the analytic based on data ingested. For instance, it may be worth running a broad query for jsp file writes first before performing a join. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-06-03 +- **Author**: Michael Haag, Splunk +- **ID**: eb65619c-4f8d-4383-a975-d352765d344b + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2022-22965](https://nvd.nist.gov/vuln/detail/CVE-2022-22965) | A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it. | 7.5 | + + + +
+
+ +#### Search + +``` + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN ("java","java.exe", "javaw.exe") by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid Processes.user +| `drop_dm_object_name(Processes)` +| join process_guid [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.jsp*" by _time Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.user +| `drop_dm_object_name(Filesystem)` +| fields _time process_guid file_path file_name file_create_time user dest process_name] +| stats count min(_time) as firstTime max(_time) as lastTime by dest process_name process_guid file_name file_path file_create_time user +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `java_writing_jsp_file_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +> :information_source: +> **java_writing_jsp_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id +* Filesystem.dest +* Filesystem.file_create_time +* Filesystem.file_name +* Filesystem.file_path +* Filesystem.process_guid +* Filesystem.user + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Known False Positives +False positives are possible and filtering may be required. Restrict by assets or filter known jsp files that are common for the environment. + +#### Associated Analytic story +* [Spring4Shell CVE-2022-22965](/stories/spring4shell_cve-2022-22965) +* [Atlassian Confluence Server and Data Center CVE-2022-26134](/stories/atlassian_confluence_server_and_data_center_cve-2022-26134) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 42.0 | 60 | 70 | An instance of $process_name$ was identified on endpoint $dest$ writing a jsp file to disk, potentially indicative of exploitation. | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/](https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/) +* [https://github.com/TheGejr/SpringShell](https://github.com/TheGejr/SpringShell) +* [https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability](https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/java_write_jsp-linux-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/java_write_jsp-linux-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/java_writing_jsp_file.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2022-06-03-linux_iptables_firewall_modification.md b/docs/_posts/2022-06-03-linux_iptables_firewall_modification.md new file mode 100644 index 0000000000..8712816018 --- /dev/null +++ b/docs/_posts/2022-06-03-linux_iptables_firewall_modification.md @@ -0,0 +1,179 @@ +--- +title: "Linux Iptables Firewall Modification" +excerpt: "Disable or Modify System Firewall +, Impair Defenses +" +categories: + - Endpoint +last_modified_at: 2022-06-03 +toc: true +toc_label: "" +tags: + - Disable or Modify System Firewall + - Impair Defenses + - Defense Evasion + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic looks for suspicious commandline that modify the iptables firewall setting of a linux machine. This technique was seen in cyclopsblink malware where it modifies the firewall setting of the compromised machine to allow traffic to its tcp port that will be used to communicate with its C2 server. + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-06-03 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 309d59dc-1e1b-49b2-9800-7cf18d12f7b7 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1562.004](https://attack.mitre.org/techniques/T1562/004/) | Disable or Modify System Firewall | Defense Evasion | + +| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*iptables *" AND Processes.process = "* --dport *" AND Processes.process = "* ACCEPT*" AND Processes.process = "*&>/dev/null*" AND Processes.process = "* tcp *" AND NOT(Processes.parent_process_path IN("/bin/*", "/lib/*", "/usr/bin/*", "/sbin/*")) by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest _time span=10s Processes.user Processes.parent_process_name Processes.parent_process_path Processes.process_path +| rex field=Processes.process "--dport (?3269 +|636 +|989 +|994 +|995 +|8443)" +| stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) as guids values(Processes.process_id) as pids dc(port) as port_count count by Processes.process_name Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user Processes.parent_process_path Processes.process_path +| where port_count >=3 +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `linux_iptables_firewall_modification_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +> :information_source: +> **linux_iptables_firewall_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_id + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase. + +#### Known False Positives +administrator may do this commandline for auditing and testing purposes. In this scenario filter is needed. + +#### Associated Analytic story +* [CyclopsBLink](/stories/cyclopsblink) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 25.0 | 50 | 50 | A commandline $process$ that may modify iptables firewall on $dest$ | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf](https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf) +* [https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html](https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/linux_iptables_firewall_modification.yml) \| *version*: **3** \ No newline at end of file diff --git a/docs/_stories/atlassian_confluence_server_and_data_center_cve-2022-26134.md b/docs/_stories/atlassian_confluence_server_and_data_center_cve-2022-26134.md new file mode 100644 index 0000000000..fd7c817eff --- /dev/null +++ b/docs/_stories/atlassian_confluence_server_and_data_center_cve-2022-26134.md @@ -0,0 +1,46 @@ +--- +title: "Atlassian Confluence Server and Data Center CVE-2022-26134" +last_modified_at: 2022-06-03 +toc: true +toc_label: "" +tags: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint + - Exploitation +--- + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} + +#### Description + +On June 2, security researchers at Volexity published a blog outlining the discovery of an unauthenticated remote code execution zero day vulnerability (CVE-2022-26134) being actively exploited in Atlassian Confluence Server and Data Center instances in the wild. Atlassian released a fix within 24 hours of the blog''s release. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-06-03 +- **Author**: Michael Haag, Splunk +- **ID**: 91623a50-41fa-4c4e-8637-c239b80ff439 + +#### Narrative + +Atlassian describes the vulnerability as an Object-Graph Navigation Language (OGNL) injection allowing an unauthenticated user to execute arbitrary code on a Confluence Server or Data Server instance. Volexity did not release proof-of-concept (POC) exploit code, but researchers there have observed coordinated, widespread exploitation. Volexity first discovered the vulnerability over the weekend on two Internet-facing web servers running Confluence Server software. The investigation was due to suspicious activity on the hosts, including JSP webshells that were written to disk. + +#### Detections + +| Name | Technique | Type | +| ----------- | ----------- |--------------| +| [Java Writing JSP File](/endpoint/java_writing_jsp_file/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application)| TTP | +| [Confluence Unauthenticated Remote Code Execution CVE-2022-26134](/web/confluence_unauthenticated_remote_code_execution_cve-2022-26134/) | [Server Software Component](/tags/#server-software-component), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application)| TTP | + +#### Reference + +* [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html](https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html) +* [https://www.splunk.com/en_us/blog/security/atlassian-confluence-vulnerability-cve-2022-26134.html](https://www.splunk.com/en_us/blog/security/atlassian-confluence-vulnerability-cve-2022-26134.html) +* [https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/](https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/) +* [https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/](https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/stories/atlassian_confluence_server_and_data_center_cve-2022-26134.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_stories/microsoft_support_diagnostic_tool_vulnerability_cve-2022-30190.md b/docs/_stories/microsoft_support_diagnostic_tool_vulnerability_cve-2022-30190.md index ee3900d3bb..d2c82762e4 100644 --- a/docs/_stories/microsoft_support_diagnostic_tool_vulnerability_cve-2022-30190.md +++ b/docs/_stories/microsoft_support_diagnostic_tool_vulnerability_cve-2022-30190.md @@ -31,8 +31,9 @@ A remote code execution vulnerability exists when MSDT is called using the URL p | Name | Technique | Type | | ----------- | ----------- |--------------| +| [Windows Command and Scripting Interpreter Hunting Path Traversal](/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Hunting | | [Windows Command and Scripting Interpreter Path Traversal Exec](/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| TTP | -| [Windows Execute Arbitrary Commands with MSDT](/endpoint/windows_execute_arbitrary_commands_with_msdt/) | [Indirect Command Execution](/tags/#indirect-command-execution)| TTP | +| [Windows Execute Arbitrary Commands with MSDT](/endpoint/windows_execute_arbitrary_commands_with_msdt/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution)| TTP | | [Windows Office Product Spawning MSDT](/endpoint/windows_office_product_spawning_msdt/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP | #### Reference diff --git a/docs/_stories/windows_defense_evasion_tactics.md b/docs/_stories/windows_defense_evasion_tactics.md index 851282b401..b396c3b240 100644 --- a/docs/_stories/windows_defense_evasion_tactics.md +++ b/docs/_stories/windows_defense_evasion_tactics.md @@ -65,6 +65,7 @@ Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adve | [SLUI Spawning a Process](/endpoint/slui_spawning_a_process/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP | | [Suspicious Reg exe Process](/endpoint/suspicious_reg_exe_process/) | [Modify Registry](/tags/#modify-registry)| TTP | | [UAC Bypass MMC Load Unsigned Dll](/endpoint/uac_bypass_mmc_load_unsigned_dll/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP | +| [Windows Command and Scripting Interpreter Hunting Path Traversal](/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Hunting | | [Windows Command and Scripting Interpreter Path Traversal Exec](/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| TTP | | [Windows Defender Exclusion Registry Entry](/endpoint/windows_defender_exclusion_registry_entry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP | | [Windows Disable Change Password Through Registry](/endpoint/windows_disable_change_password_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly | diff --git a/docs/mitre-map/coverage.json b/docs/mitre-map/coverage.json index 8035509aff..cf184a001b 100644 --- a/docs/mitre-map/coverage.json +++ b/docs/mitre-map/coverage.json @@ -256,8 +256,8 @@ }, { "techniqueID": "T1218", - "score": 52, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_diskshadow_proxy_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml" + "score": 53, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_diskshadow_proxy_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml" }, { "techniqueID": "T1036", @@ -341,8 +341,8 @@ }, { "techniqueID": "T1059", - "score": 39, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_carry_out_string_command_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/macos_lolbin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_writing_dynamicwrapperx.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_with_discord_dns_query.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/vbscript_execution_using_wscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_module_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml" + "score": 40, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_carry_out_string_command_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/macos_lolbin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_writing_dynamicwrapperx.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_with_discord_dns_query.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/vbscript_execution_using_wscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_module_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml" }, { "techniqueID": "T1105", @@ -511,8 +511,8 @@ }, { "techniqueID": "T1505", - "score": 5, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/spring4shell_payload_url_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_jsp_request_via_url.yml" + "score": 6, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/w3wp_spawning_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/spring4shell_payload_url_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_jsp_request_via_url.yml" }, { "techniqueID": "T1505.003", @@ -521,8 +521,8 @@ }, { "techniqueID": "T1190", - "score": 25, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hunting_for_log4shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/java_class_file_download_by_java_user_agent.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/java_writing_jsp_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_java_spawning_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_abuse_via_ssrf.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_java_spawning_shells.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winrm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_zerologon_via_zeek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/detect_f5_tmui_rce_cve_2020_5902.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/sql_injection_with_long_urls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/log4shell_jndi_payload_injection_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/spring4shell_payload_url_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/vmware_server_side_template_injection_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_jsp_request_via_url.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_spring4shell_http_request_class_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_spring_cloud_function_functionrouter.yml" + "score": 26, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hunting_for_log4shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/java_class_file_download_by_java_user_agent.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/java_writing_jsp_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_java_spawning_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_abuse_via_ssrf.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_java_spawning_shells.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winrm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_zerologon_via_zeek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/detect_f5_tmui_rce_cve_2020_5902.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/sql_injection_with_long_urls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/log4shell_jndi_payload_injection_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/spring4shell_payload_url_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/vmware_server_side_template_injection_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_jsp_request_via_url.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_spring4shell_http_request_class_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_spring_cloud_function_functionrouter.yml" }, { "techniqueID": "T1218.001", @@ -981,8 +981,8 @@ }, { "techniqueID": "T1202", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml" }, { "techniqueID": "T1204.001", @@ -1112,7 +1112,7 @@ "#096ed7" ], "minValue": 0, - "maxValue": 52 + "maxValue": 53 }, "filters": { "platforms": [ From 84420a1912d00020a2cb775fb5ef93f387e9b14c Mon Sep 17 00:00:00 2001 From: Danny Leung Date: Mon, 6 Jun 2022 15:01:26 -0700 Subject: [PATCH 093/148] PEX-76: fix the detections obj to include the J2 docs fields --- .../builder/security_content_story_builder.py | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py index d1c3d041dd..6358830596 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py @@ -41,8 +41,20 @@ class SecurityContentStoryBuilder(StoryBuilder): for detection_analytic_story in detection.tags.analytic_story: if detection_analytic_story == self.story.name: matched_detection_names.append(str('ESCU - ' + detection.name + ' - Rule')) - # SSE-638: detections should only contain the 'name' attribute - matched_detections.append({"name" : detection.name}) + # SSE-638: detections object should at least contain the name attribute. + # We also need a minimal set of the following attributes to satisfy docgen (doc_stories.j2): + # name, source, type, tags.mitre_attack_enrichments.mitre_attack_technique + mitre_attack_enrichments_list = [] + if (detection.tags.mitre_attack_enrichments): + for attack in detection.tags.mitre_attack_enrichments: + mitre_attack_enrichments_list.append({"mitre_attack_technique": attack.mitre_attack_technique}) + tags_obj = {"mitre_attack_enrichments": mitre_attack_enrichments_list} + matched_detections.append({ + "name": detection.name, + "source": detection.source, + "type": detection.type, + "tags": tags_obj + }) datamodels.update(detection.datamodel) if detection.tags.kill_chain_phases: kill_chain_phases.update(detection.tags.kill_chain_phases) From d3da2879054dd22e95c4432b0aeac2d7716daf49 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 6 Jun 2022 16:08:06 -0700 Subject: [PATCH 094/148] Added support for specifying a custom index to delete after a test in each attack_data dataset in the test file. It is important to have this level of control (per-dataset), not just per test or per-file! --- .../modules/testing_service.py | 31 +++++++++++++------ 1 file changed, 22 insertions(+), 9 deletions(-) diff --git a/bin/docker_detection_tester/modules/testing_service.py b/bin/docker_detection_tester/modules/testing_service.py index 8befb4691d..5a99d66840 100644 --- a/bin/docker_detection_tester/modules/testing_service.py +++ b/bin/docker_detection_tester/modules/testing_service.py @@ -11,19 +11,21 @@ import requests from modules.DataManipulation import DataManipulation from modules import splunk_sdk import timeit -from typing import Union +from typing import Union, Tuple from os.path import relpath from tempfile import mkdtemp import datetime import http.client +DEFAULT_DATA_INDEX = "main" + def test_detection_wrapper(container_name:str, splunk_ip:str, splunk_password:str, splunk_port:int, test_file:str, attack_data_root_folder, wait_on_failure:bool=False, wait_on_completion:bool=False)->dict: one_test_start = timeit.default_timer() uuid_var = str(uuid.uuid4()) - result_test = test_detection(splunk_ip, splunk_port, container_name, splunk_password, test_file, uuid_var, attack_data_root_folder) + result_test, indices_to_delete = test_detection(splunk_ip, splunk_port, container_name, splunk_password, test_file, uuid_var, attack_data_root_folder) one_test_stop = timeit.default_timer() if result_test is None: @@ -45,8 +47,10 @@ def test_detection_wrapper(container_name:str, splunk_ip:str, splunk_password:st wait_on_delete = {'message':"\n\n\n****SEARCH SUCCESS : Allowing time to examine search/data****"} else: wait_on_delete = None - - splunk_sdk.delete_attack_data(splunk_ip, splunk_password, splunk_port, wait_on_delete, search_string, test_file) + + for index_to_delete in indices_to_delete: + print(f"Deleting index data for {test_file}: {index_to_delete}") + splunk_sdk.delete_attack_data(splunk_ip, splunk_password, splunk_port, wait_on_delete, search_string, test_file, index = index_to_delete) return result_test @@ -66,7 +70,7 @@ def get_service(splunk_ip:str, splunk_port:int, splunk_password:str): raise(Exception("Unable to connect to Splunk instance: " + str(e))) return service -def test_detection(splunk_ip:str, splunk_port:int, container_name:str, splunk_password:str, test_file:str, uuid_var, attack_data_root_folder)->Union[dict,None]: +def test_detection(splunk_ip:str, splunk_port:int, container_name:str, splunk_password:str, test_file:str, uuid_var, attack_data_root_folder)->Tuple[Union[dict,None], set[str]]: test_file_obj = load_file(os.path.join("security_content/", test_file)) @@ -89,9 +93,18 @@ def test_detection(splunk_ip:str, splunk_port:int, container_name:str, splunk_pa - + indices_to_delete = set() for attack_data in test_file_obj['tests'][0]['attack_data']: url = attack_data['data'] + + if 'custom_index' in attack_data: + print(f"Found a custom index for {test_file}: {attack_data['custom_index']}") + data_upload_index = attack_data['custom_index'] + else: + data_upload_index = DEFAULT_DATA_INDEX + + indices_to_delete.add(data_upload_index) + r = requests.get(url, allow_redirects=True) target_file = os.path.join(folder_name, attack_data['file_name']) with open(target_file, 'wb') as target: @@ -108,7 +121,7 @@ def test_detection(splunk_ip:str, splunk_port:int, container_name:str, splunk_pa try: service = get_service(splunk_ip, splunk_port, splunk_password) - test_index = service.indexes["main"] + test_index = service.indexes[data_upload_index] with open(target_file, 'rb') as target: test_index.submit(target.read(), sourcetype=attack_data['sourcetype'], source=attack_data['source']) @@ -122,7 +135,7 @@ def test_detection(splunk_ip:str, splunk_port:int, container_name:str, splunk_pa - if not splunk_sdk.wait_for_indexing_to_complete(splunk_ip, splunk_port, splunk_password, attack_data['sourcetype'], "main"): + if not splunk_sdk.wait_for_indexing_to_complete(splunk_ip, splunk_port, splunk_password, attack_data['sourcetype'], data_upload_index): raise Exception("There was an error waiting for indexing to complete.") #Allow some time for the data to be ingested and processed @@ -169,7 +182,7 @@ def test_detection(splunk_ip:str, splunk_port:int, container_name:str, splunk_pa result_test['attack_data_directory'] = abs_folder_path - return result_test + return result_test, indices_to_delete def load_file(file_path): From 7a18850877ca77a2e47afe414e7fd095d4547097 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 6 Jun 2022 16:53:15 -0700 Subject: [PATCH 095/148] Forcing a timeout... certain indexes may continue growing and never have the same number of events! --- bin/docker_detection_tester/modules/splunk_sdk.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/bin/docker_detection_tester/modules/splunk_sdk.py b/bin/docker_detection_tester/modules/splunk_sdk.py index f919502db1..b0526caecd 100644 --- a/bin/docker_detection_tester/modules/splunk_sdk.py +++ b/bin/docker_detection_tester/modules/splunk_sdk.py @@ -94,11 +94,13 @@ def get_number_of_indexed_events(splunk_host, splunk_port, splunk_password, inde def wait_for_indexing_to_complete(splunk_host, splunk_port, splunk_password, sourcetype:str, index:str, check_interval_seconds:int=10)->bool: - + MAX_WAIT_TIME = 60 startTime = timeit.default_timer() previous_count = -1 time.sleep(check_interval_seconds) while True: + if (timeit.default_timer() - startTime) > 60: + print("force timeout! assume we are done indexing") new_count = get_number_of_indexed_events(splunk_host, splunk_port, splunk_password, index=index, sourcetype=sourcetype) #print(f"Previous Count [{previous_count}] New Count [{new_count}]") if previous_count == -1: From 8212e22bcb8f89fd75dce750e6bc52a10252789c Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 6 Jun 2022 17:03:59 -0700 Subject: [PATCH 096/148] Forgot to include a break on the forced timeout --- bin/docker_detection_tester/modules/splunk_sdk.py | 1 + 1 file changed, 1 insertion(+) diff --git a/bin/docker_detection_tester/modules/splunk_sdk.py b/bin/docker_detection_tester/modules/splunk_sdk.py index b0526caecd..bd52e8a900 100644 --- a/bin/docker_detection_tester/modules/splunk_sdk.py +++ b/bin/docker_detection_tester/modules/splunk_sdk.py @@ -101,6 +101,7 @@ def wait_for_indexing_to_complete(splunk_host, splunk_port, splunk_password, sou while True: if (timeit.default_timer() - startTime) > 60: print("force timeout! assume we are done indexing") + break new_count = get_number_of_indexed_events(splunk_host, splunk_port, splunk_password, index=index, sourcetype=sourcetype) #print(f"Previous Count [{previous_count}] New Count [{new_count}]") if previous_count == -1: From aca19c102be10f2850ff14228a2f09b4db38e6dc Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 6 Jun 2022 17:15:08 -0700 Subject: [PATCH 097/148] Forgot to include return type from function --- bin/docker_detection_tester/modules/splunk_sdk.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/docker_detection_tester/modules/splunk_sdk.py b/bin/docker_detection_tester/modules/splunk_sdk.py index bd52e8a900..db97396bdc 100644 --- a/bin/docker_detection_tester/modules/splunk_sdk.py +++ b/bin/docker_detection_tester/modules/splunk_sdk.py @@ -101,7 +101,7 @@ def wait_for_indexing_to_complete(splunk_host, splunk_port, splunk_password, sou while True: if (timeit.default_timer() - startTime) > 60: print("force timeout! assume we are done indexing") - break + return True new_count = get_number_of_indexed_events(splunk_host, splunk_port, splunk_password, index=index, sourcetype=sourcetype) #print(f"Previous Count [{previous_count}] New Count [{new_count}]") if previous_count == -1: From 9191057b1beac8182c9d2312613c50e70a1a3d1a Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 7 Jun 2022 12:55:54 -0700 Subject: [PATCH 098/148] Changed to use a special host field to denote the source of all the data sets that we upload. This means that we don't need hacks to get around waiting for all of the data to finish indexing. --- .../modules/splunk_sdk.py | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/bin/docker_detection_tester/modules/splunk_sdk.py b/bin/docker_detection_tester/modules/splunk_sdk.py index db97396bdc..004d3a0ddc 100644 --- a/bin/docker_detection_tester/modules/splunk_sdk.py +++ b/bin/docker_detection_tester/modules/splunk_sdk.py @@ -9,6 +9,9 @@ import timeit import datetime from typing import Union +DEFAULT_EVENT_HOST = "ATTACK_DATA_HOST" +DEFAULT_DATA_INDEX = "main" + def enable_delete_for_admin(splunk_host:str, splunk_port:int, splunk_password:str)->bool: try: service = client.connect( @@ -58,7 +61,7 @@ def enable_delete_for_admin(splunk_host:str, splunk_port:int, splunk_password:st -def get_number_of_indexed_events(splunk_host, splunk_port, splunk_password, index:str, sourcetype:Union[str,None]=None )->int: +def get_number_of_indexed_events(splunk_host, splunk_port, splunk_password, index:str, event_host:str=DEFAULT_EVENT_HOST, sourcetype:Union[str,None]=None )->int: try: service = client.connect( @@ -71,9 +74,9 @@ def get_number_of_indexed_events(splunk_host, splunk_port, splunk_password, inde raise(Exception("Unable to connect to Splunk instance: " + str(e))) if sourcetype is not None: - search = '''search index="%s" sourcetype="%s" | stats count'''%(index,sourcetype) + search = f'''search index="{index}" sourcetype="{sourcetype}" host="{event_host} | stats count''' else: - search = '''search index="%s" | stats count'''%(index) + search = f'''search index="{index}" host="{event_host}" | stats count''' kwargs = {"exec_mode":"blocking"} try: search_result = service.jobs.create(search, **kwargs) @@ -94,14 +97,10 @@ def get_number_of_indexed_events(splunk_host, splunk_port, splunk_password, inde def wait_for_indexing_to_complete(splunk_host, splunk_port, splunk_password, sourcetype:str, index:str, check_interval_seconds:int=10)->bool: - MAX_WAIT_TIME = 60 startTime = timeit.default_timer() previous_count = -1 time.sleep(check_interval_seconds) while True: - if (timeit.default_timer() - startTime) > 60: - print("force timeout! assume we are done indexing") - return True new_count = get_number_of_indexed_events(splunk_host, splunk_port, splunk_password, index=index, sourcetype=sourcetype) #print(f"Previous Count [{previous_count}] New Count [{new_count}]") if previous_count == -1: @@ -303,7 +302,7 @@ def test_detection_search(splunk_host:str, splunk_port:int, splunk_password:str, return test_results -def delete_attack_data(splunk_host:str, splunk_password:str, splunk_port:int, wait_on_delete:Union[dict,None], search_string:str, detection_filename:str, index:str="main")->bool: +def delete_attack_data(splunk_host:str, splunk_password:str, splunk_port:int, wait_on_delete:Union[dict,None], search_string:str, detection_filename:str, index:str=DEFAULT_DATA_INDEX, host:str=DEFAULT_EVENT_HOST)->bool: try: service = client.connect( @@ -328,8 +327,8 @@ def delete_attack_data(splunk_host:str, splunk_password:str, splunk_port:int, wa - while (get_number_of_indexed_events(splunk_host, splunk_port, splunk_password, index=index) != 0) : - splunk_search = f'search index={index} | delete' + while (get_number_of_indexed_events(splunk_host, splunk_port, splunk_password, index=index, event_host=host) != 0) : + splunk_search = f'search index="{index}" host="{host}" | delete' kwargs = { "exec_mode": "blocking", From 7c2047e2cf2d2bc2bb312fcb5392f7054600c87f Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Tue, 7 Jun 2022 13:05:05 -0700 Subject: [PATCH 099/148] Unbalanced quote - fixed --- bin/docker_detection_tester/modules/splunk_sdk.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/docker_detection_tester/modules/splunk_sdk.py b/bin/docker_detection_tester/modules/splunk_sdk.py index 004d3a0ddc..6eeb06ee37 100644 --- a/bin/docker_detection_tester/modules/splunk_sdk.py +++ b/bin/docker_detection_tester/modules/splunk_sdk.py @@ -74,7 +74,7 @@ def get_number_of_indexed_events(splunk_host, splunk_port, splunk_password, inde raise(Exception("Unable to connect to Splunk instance: " + str(e))) if sourcetype is not None: - search = f'''search index="{index}" sourcetype="{sourcetype}" host="{event_host} | stats count''' + search = f'''search index="{index}" sourcetype="{sourcetype}" host="{event_host}" | stats count''' else: search = f'''search index="{index}" host="{event_host}" | stats count''' kwargs = {"exec_mode":"blocking"} From 3fb342d4c40951db605409c507e2899dcd6ca114 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 8 Jun 2022 10:31:53 -0700 Subject: [PATCH 100/148] Fixed improperly named macro. Renamed the macro in the tests that use that macro. Added the optional field, "custom_index" to the test files which MUST upload data into the _audit index. This branch doesn't support custom_index yet, but those changes will be merged soon from another branch. --- ...lunk_protocol_impersonation_weak_encryption_selfsigned.yml | 2 +- ...k_protocol_impersonation_weak_encryption_simplerequest.yml | 2 +- macros/splk_cert_validation_tls_selfsigned.yml | 4 ---- macros/{splk_cert_validation_tls.yml => splunk_python.yml} | 2 +- ...nk_command_and_scripting_interpreter_delete_usage.test.yml | 1 + ..._command_and_scripting_interpreter_risky_commands.test.yml | 1 + ...plunk_digital_certificates_infrastructure_version.test.yml | 1 + ...tocol_impersonation_weak_encryption_configuration.test.yml | 1 + tests/application/splunk_user_enumeration_attempt.test.yml | 1 + 9 files changed, 8 insertions(+), 7 deletions(-) delete mode 100644 macros/splk_cert_validation_tls_selfsigned.yml rename macros/{splk_cert_validation_tls.yml => splunk_python.yml} (76%) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml index ef8644690a..bb4d914929 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -5,7 +5,7 @@ date: '2022-05-26' author: Rod Soto, Splunk type: Hunting datamodel: [] -search: '| `splk_cert_validation_tls_selfsigned` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | splunk_protocol_impersonation_weak_encryption_selfsigned_filter' +search: '| `splunk_python` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | splunk_protocol_impersonation_weak_encryption_selfsigned_filter' description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. known_false_positives: This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward. diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index cb24899fd6..f4d39041c9 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -5,7 +5,7 @@ date: '2022-05-24' author: Rod Soto, Splunk type: Hunting datamodel: [] -search: '| `splk_cert_validation_tls` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | splunk_protocol_impersonation_weak_encryption_simplerequest_filter' +search: '| `splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | splunk_protocol_impersonation_weak_encryption_simplerequest_filter' description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store.This search warns about failure to validate certification using python3 request. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. diff --git a/macros/splk_cert_validation_tls_selfsigned.yml b/macros/splk_cert_validation_tls_selfsigned.yml deleted file mode 100644 index 2a9c676d9d..0000000000 --- a/macros/splk_cert_validation_tls_selfsigned.yml +++ /dev/null @@ -1,4 +0,0 @@ -definition: index=_internal sourcetype=splunkd -description: customer specific splunk configurations(eg- index, source, sourcetype). - Replace the macro definition with configurations for your Splunk Environmnent. -name: splunk_protocol_impersonation_weak_encryption_selfsigned diff --git a/macros/splk_cert_validation_tls.yml b/macros/splunk_python.yml similarity index 76% rename from macros/splk_cert_validation_tls.yml rename to macros/splunk_python.yml index 81d3154034..308c5cb662 100644 --- a/macros/splk_cert_validation_tls.yml +++ b/macros/splunk_python.yml @@ -1,4 +1,4 @@ definition: index=_internal sourcetype=splunk_python description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. -name: splunk_protocol_impersonation_weak_encryption_simplerequest +name: splunk_python diff --git a/tests/application/splunk_command_and_scripting_interpreter_delete_usage.test.yml b/tests/application/splunk_command_and_scripting_interpreter_delete_usage.test.yml index a44479a465..76dad686b1 100644 --- a/tests/application/splunk_command_and_scripting_interpreter_delete_usage.test.yml +++ b/tests/application/splunk_command_and_scripting_interpreter_delete_usage.test.yml @@ -12,3 +12,4 @@ tests: sourcetype: audittrail update_timestamp: true update_timestamp: true + custom_index: _audit diff --git a/tests/application/splunk_command_and_scripting_interpreter_risky_commands.test.yml b/tests/application/splunk_command_and_scripting_interpreter_risky_commands.test.yml index 81490c8a0e..c29ea0ff8f 100644 --- a/tests/application/splunk_command_and_scripting_interpreter_risky_commands.test.yml +++ b/tests/application/splunk_command_and_scripting_interpreter_risky_commands.test.yml @@ -11,3 +11,4 @@ tests: source: audittrail sourcetype: audittrail update_timestamp: true + custom_index: _audit \ No newline at end of file diff --git a/tests/application/splunk_digital_certificates_infrastructure_version.test.yml b/tests/application/splunk_digital_certificates_infrastructure_version.test.yml index a65603b137..c924075332 100644 --- a/tests/application/splunk_digital_certificates_infrastructure_version.test.yml +++ b/tests/application/splunk_digital_certificates_infrastructure_version.test.yml @@ -11,4 +11,5 @@ tests: source: audittrail sourcetype: audittrail update_timestamp: true + custom_index: _audit diff --git a/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml b/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml index 30ec9e3e5f..fe62b80f8f 100644 --- a/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml +++ b/tests/application/splunk_protocol_impersonation_weak_encryption_configuration.test.yml @@ -11,3 +11,4 @@ tests: source: audittrail sourcetype: audittrail update_timestamp: true + custom_index: _audit diff --git a/tests/application/splunk_user_enumeration_attempt.test.yml b/tests/application/splunk_user_enumeration_attempt.test.yml index e2672a23c5..767973f5c4 100644 --- a/tests/application/splunk_user_enumeration_attempt.test.yml +++ b/tests/application/splunk_user_enumeration_attempt.test.yml @@ -10,3 +10,4 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/splunkd_auth/audittrail.log source: audittrail sourcetype: audittrail + custom_index: _audit From e8abbd916b5c54aed15bf89d02521cf4abce87e0 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 8 Jun 2022 11:08:21 -0700 Subject: [PATCH 101/148] Added missing _internal custom_indexes to relevant test files. Removed the | character from searches that use index and sourcetype macros at the beginning of the search. --- .../splunk_digital_certificates_lack_of_encryption.yml | 2 +- ...splunk_protocol_impersonation_weak_encryption_selfsigned.yml | 2 +- ...unk_protocol_impersonation_weak_encryption_simplerequest.yml | 2 +- .../splunk_digital_certificates_lack_of_encryption.test.yml | 1 + ...splunk_process_injection_forwarder_bundle_downloads.test.yml | 1 + 5 files changed, 5 insertions(+), 3 deletions(-) diff --git a/detections/application/splunk_digital_certificates_lack_of_encryption.yml b/detections/application/splunk_digital_certificates_lack_of_encryption.yml index 8b2f4ab058..b156555281 100644 --- a/detections/application/splunk_digital_certificates_lack_of_encryption.yml +++ b/detections/application/splunk_digital_certificates_lack_of_encryption.yml @@ -6,7 +6,7 @@ author: Lou Stella, Splunk type: Anomaly datamodel: [] description: On June 10th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. The fixes for these require upgrading to at least Splunk 9.0 on the forwarder as well. This is a great opportunity to configure TLS across the environment. This search looks for forwarders that are not using TLS and adds risk to those entities. -search: '| `splunkd` group="tcpin_connections" ssl="false" | stats values(sourceIp) latest(fwdType) latest(version) by hostname | `splunk_digital_certificates_lack_of_encryption_filter`' +search: '`splunkd` group="tcpin_connections" ssl="false" | stats values(sourceIp) latest(fwdType) latest(version) by hostname | `splunk_digital_certificates_lack_of_encryption_filter`' how_to_implement: This anomaly search looks for forwarder connections that are not currently using TLS. It then presents the source IP, the type of forwarder, and the version of the forwarder. You can also remove the "ssl=false" argument from the initial stanza in order to get a full list of all your forwarders that are sending data, and the version of Splunk software they are running, for audit purposes. known_false_positives: None at this time references: diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml index bb4d914929..adc754f31b 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -5,7 +5,7 @@ date: '2022-05-26' author: Rod Soto, Splunk type: Hunting datamodel: [] -search: '| `splunk_python` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | splunk_protocol_impersonation_weak_encryption_selfsigned_filter' +search: '`splunk_python` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | splunk_protocol_impersonation_weak_encryption_selfsigned_filter' description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. known_false_positives: This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward. diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index f4d39041c9..84cf983f75 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -5,7 +5,7 @@ date: '2022-05-24' author: Rod Soto, Splunk type: Hunting datamodel: [] -search: '| `splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | splunk_protocol_impersonation_weak_encryption_simplerequest_filter' +search: '`splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | splunk_protocol_impersonation_weak_encryption_simplerequest_filter' description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store.This search warns about failure to validate certification using python3 request. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. diff --git a/tests/application/splunk_digital_certificates_lack_of_encryption.test.yml b/tests/application/splunk_digital_certificates_lack_of_encryption.test.yml index 6fc83c2e2f..c10d9691bf 100644 --- a/tests/application/splunk_digital_certificates_lack_of_encryption.test.yml +++ b/tests/application/splunk_digital_certificates_lack_of_encryption.test.yml @@ -11,3 +11,4 @@ tests: source: "/opt/splunk/var/log/splunk/metrics.log" sourcetype: splunkd update_timestamp: false + custom_index: _internal diff --git a/tests/application/splunk_process_injection_forwarder_bundle_downloads.test.yml b/tests/application/splunk_process_injection_forwarder_bundle_downloads.test.yml index ebe74285c3..56f48d2ca3 100644 --- a/tests/application/splunk_process_injection_forwarder_bundle_downloads.test.yml +++ b/tests/application/splunk_process_injection_forwarder_bundle_downloads.test.yml @@ -11,3 +11,4 @@ tests: source: "/opt/splunk/var/log/splunk/splunkd.log" sourcetype: splunkd update_timestamp: false + custom_index: _internal From 47cd84d377aa1acf7d8a19a9e87d8061cef28b28 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 8 Jun 2022 11:46:42 -0700 Subject: [PATCH 102/148] Wrong sourcetype declared in one of the test files, causing it to fail. Fixed missing backticks on some macros. --- ...plunk_protocol_impersonation_weak_encryption_selfsigned.yml | 2 +- ...nk_protocol_impersonation_weak_encryption_simplerequest.yml | 2 +- ...otocol_impersonation_weak_encryption_simplerequest.test.yml | 3 ++- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml index adc754f31b..ed8fa37722 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -5,7 +5,7 @@ date: '2022-05-26' author: Rod Soto, Splunk type: Hunting datamodel: [] -search: '`splunk_python` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | splunk_protocol_impersonation_weak_encryption_selfsigned_filter' +search: '`splunk_python` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | `splunk_protocol_impersonation_weak_encryption_selfsigned_filter`' description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. known_false_positives: This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward. diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index 84cf983f75..07c3137ce6 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -5,7 +5,7 @@ date: '2022-05-24' author: Rod Soto, Splunk type: Hunting datamodel: [] -search: '`splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | splunk_protocol_impersonation_weak_encryption_simplerequest_filter' +search: '`splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | `splunk_protocol_impersonation_weak_encryption_simplerequest_filter`' description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store.This search warns about failure to validate certification using python3 request. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. diff --git a/tests/application/splunk_protocol_impersonation_weak_encryption_simplerequest.test.yml b/tests/application/splunk_protocol_impersonation_weak_encryption_simplerequest.test.yml index 12a800bf11..061bab1df9 100644 --- a/tests/application/splunk_protocol_impersonation_weak_encryption_simplerequest.test.yml +++ b/tests/application/splunk_protocol_impersonation_weak_encryption_simplerequest.test.yml @@ -9,4 +9,5 @@ tests: - file_name: splk_protocol_impersonation_weak_encryption_simplerequest.txt data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splk_protocol_impersonation_weak_encryption_simplerequest.txt source: "/opt/splunk/var/log/splunk/splunkd.log" - sourcetype: splunkd + sourcetype: splunk_python + custom_index: _internal From 10b2b29122c065298f98c6adf83c02d4152b954d Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 8 Jun 2022 12:14:46 -0700 Subject: [PATCH 103/148] Adding appropriate custom_index to detection and fixing naming error and file_name error --- ...col_impersonation_weak_encryption_selfsigned.test.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml b/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml index 12a800bf11..d97cf683a0 100644 --- a/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml +++ b/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml @@ -1,4 +1,4 @@ -name: Splunk protocol impersonation weak encryption simplerequest Unit Test +name: Splunk protocol impersonation weak encryption selfsigned Unit Test tests: - name: Splunk protocol impersonation weak encryption simplerequest file: application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -6,7 +6,8 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: splk_protocol_impersonation_weak_encryption_simplerequest.txt - data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splk_protocol_impersonation_weak_encryption_simplerequest.txt - source: "/opt/splunk/var/log/splunk/splunkd.log" + - file_name: splunk_protocol_impersonation_weak_encryption_selfsigned.txt + data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splunk_protocol_impersonation_weak_encryption_selfsigned.txt + source: "/opt/splun/var/log/splunk/splunkd.log" sourcetype: splunkd + custom_index: _internal From 41c6cdbfae9fa23990fbe5da73a39c19621bb015 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 8 Jun 2022 15:34:29 -0400 Subject: [PATCH 104/148] fixing wrong field name --- .../endpoint/suspicious_process_with_discord_dns_query.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/suspicious_process_with_discord_dns_query.yml b/detections/endpoint/suspicious_process_with_discord_dns_query.yml index 0724a6c5fb..dc874c2702 100644 --- a/detections/endpoint/suspicious_process_with_discord_dns_query.yml +++ b/detections/endpoint/suspicious_process_with_discord_dns_query.yml @@ -11,7 +11,7 @@ description: This analytic identifies a process making a DNS query to Discord, a by adversaries, as seen in the WhisperGate campaign, to host and download malicious. external files. A process resolving a Discord DNS name could be an indicator of malware trying to download files from Discord for further execution. -search: '`sysmon` EventCode=22 QueryName IN ("*discord*") process_path != "*\\AppData\\Local\\Discord\\*" +search: '`sysmon` EventCode=22 QueryName IN ("*discord*") Image != "*\\AppData\\Local\\Discord\\*" AND Image != "*\\Program Files*" AND Image != "discord.exe" | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name QueryResults Computer | `security_content_ctime(firstTime)` From fe2713e07729f3e9a06ccbeaf9a019e3647014ff Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 8 Jun 2022 12:40:52 -0700 Subject: [PATCH 105/148] Fixed a detection which was using the wrong macro --- ...splunk_protocol_impersonation_weak_encryption_selfsigned.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml index ed8fa37722..97cdca736e 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -5,7 +5,7 @@ date: '2022-05-26' author: Rod Soto, Splunk type: Hunting datamodel: [] -search: '`splunk_python` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | `splunk_protocol_impersonation_weak_encryption_selfsigned_filter`' +search: '`splunkd` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | `splunk_protocol_impersonation_weak_encryption_selfsigned_filter`' description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. known_false_positives: This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward. From ec0c39c8d5c8a8db797dce0c1963d629041f9bc4 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 8 Jun 2022 16:24:39 -0400 Subject: [PATCH 106/148] updating wrong field --- detections/endpoint/mshtml_module_load_in_office_product.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/mshtml_module_load_in_office_product.yml index b8f229bd70..10ec4eb2d1 100644 --- a/detections/endpoint/mshtml_module_load_in_office_product.yml +++ b/detections/endpoint/mshtml_module_load_in_office_product.yml @@ -14,7 +14,7 @@ description: The following detection identifies the module load of mshtml.dll in search: '`sysmon` EventID=7 process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, - ImageLoaded, OriginalFileName, ProcessId | rename Computer as dest | `security_content_ctime(firstTime)` + ImageLoaded, OriginalFileName, ProcessGuid | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mshtml_module_load_in_office_product_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process names and image loads from your endpoints. If you are using From 5e36835ce925a710d455a6c5160965d8e4b7cd65 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 8 Jun 2022 14:57:33 -0700 Subject: [PATCH 107/148] Moving default data index definition to splunk_sdk file. --- bin/docker_detection_tester/modules/testing_service.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bin/docker_detection_tester/modules/testing_service.py b/bin/docker_detection_tester/modules/testing_service.py index 5a99d66840..ac022d3b6a 100644 --- a/bin/docker_detection_tester/modules/testing_service.py +++ b/bin/docker_detection_tester/modules/testing_service.py @@ -18,7 +18,7 @@ import datetime import http.client -DEFAULT_DATA_INDEX = "main" + def test_detection_wrapper(container_name:str, splunk_ip:str, splunk_password:str, splunk_port:int, test_file:str, attack_data_root_folder, wait_on_failure:bool=False, wait_on_completion:bool=False)->dict: @@ -101,7 +101,7 @@ def test_detection(splunk_ip:str, splunk_port:int, container_name:str, splunk_pa print(f"Found a custom index for {test_file}: {attack_data['custom_index']}") data_upload_index = attack_data['custom_index'] else: - data_upload_index = DEFAULT_DATA_INDEX + data_upload_index = splunk_sdk.DEFAULT_DATA_INDEX indices_to_delete.add(data_upload_index) From 8eb675522ef6f823ac1da34451e00fb983eba12b Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 8 Jun 2022 15:21:54 -0700 Subject: [PATCH 108/148] Moved printout of delete status updates to a better location and condensed multiple printouts for multiple indices to 1. --- .../modules/splunk_sdk.py | 77 ++++++++++--------- .../modules/testing_service.py | 5 +- 2 files changed, 41 insertions(+), 41 deletions(-) diff --git a/bin/docker_detection_tester/modules/splunk_sdk.py b/bin/docker_detection_tester/modules/splunk_sdk.py index 6eeb06ee37..2ad652aae6 100644 --- a/bin/docker_detection_tester/modules/splunk_sdk.py +++ b/bin/docker_detection_tester/modules/splunk_sdk.py @@ -302,7 +302,7 @@ def test_detection_search(splunk_host:str, splunk_port:int, splunk_password:str, return test_results -def delete_attack_data(splunk_host:str, splunk_password:str, splunk_port:int, wait_on_delete:Union[dict,None], search_string:str, detection_filename:str, index:str=DEFAULT_DATA_INDEX, host:str=DEFAULT_EVENT_HOST)->bool: +def delete_attack_data(splunk_host:str, splunk_password:str, splunk_port:int, wait_on_delete:Union[dict,None], search_string:str, detection_filename:str, indices:list[str]=[DEFAULT_DATA_INDEX], host:str=DEFAULT_EVENT_HOST)->bool: try: service = client.connect( @@ -326,47 +326,48 @@ def delete_attack_data(splunk_host:str, splunk_password:str, splunk_port:int, wa data_exists = True + #print(f"Deleting data for {detection_filename}: {indices}") + for index in indices: + while (get_number_of_indexed_events(splunk_host, splunk_port, splunk_password, index=index, event_host=host) != 0) : + splunk_search = f'search index="{index}" host="{host}" | delete' - while (get_number_of_indexed_events(splunk_host, splunk_port, splunk_password, index=index, event_host=host) != 0) : - splunk_search = f'search index="{index}" host="{host}" | delete' + kwargs = { + "exec_mode": "blocking", + "dispatch.earliest_time": "-1d", + "dispatch.latest_time": "now"} + try: + + job = service.jobs.create(splunk_search, **kwargs) + reader = results.ResultsReader(job) - kwargs = { - "exec_mode": "blocking", - "dispatch.earliest_time": "-1d", - "dispatch.latest_time": "now"} - try: - - job = service.jobs.create(splunk_search, **kwargs) - reader = results.ResultsReader(job) + + ''' + error_in_results = False + for result in reader: + if hasattr(result,"message") and hasattr(result,"type") and ("You have insufficient privileges to delete events" in result.message or result.type == "FATAL"): + print("Delete is not enabled for admin: [%s] - enabling delete and trying to delete again..."%(result.message), file=sys.stderr) + if already_enabled_delete is True: + print("We already enabled delete, but the setting did not take effect.") + raise(Exception("Enabling delete command failed to take effect")) + if enable_delete_for_admin(splunk_host, splunk_port,splunk_password) != True: + raise(Exception("Failure enabling delete for admin. We cannot continue")) + # We enabled delete, so now we will try to delete again + already_enabled_delete = True + break + else: + #This is not one of the error messages, do nothing + pass + ''' + #No need to issue Delete command again, we will now break out of the loop + #if error_in_results is False: + # data_exists = False - - ''' - error_in_results = False - for result in reader: - if hasattr(result,"message") and hasattr(result,"type") and ("You have insufficient privileges to delete events" in result.message or result.type == "FATAL"): - print("Delete is not enabled for admin: [%s] - enabling delete and trying to delete again..."%(result.message), file=sys.stderr) - if already_enabled_delete is True: - print("We already enabled delete, but the setting did not take effect.") - raise(Exception("Enabling delete command failed to take effect")) - if enable_delete_for_admin(splunk_host, splunk_port,splunk_password) != True: - raise(Exception("Failure enabling delete for admin. We cannot continue")) - # We enabled delete, so now we will try to delete again - already_enabled_delete = True - break - else: - #This is not one of the error messages, do nothing - pass - ''' - #No need to issue Delete command again, we will now break out of the loop - #if error_in_results is False: - # data_exists = False + #Otherwise, we will loop again - #Otherwise, we will loop again - - except Exception as e: - print(f"Trouble deleting data from a run.... we will try again: {str(e)}") - time.sleep(5) - #raise(Exception("Unable to delete data from a run: " + str(e))) + except Exception as e: + print(f"Trouble deleting data from a run.... we will try again: {str(e)}") + time.sleep(5) + #raise(Exception("Unable to delete data from a run: " + str(e))) return True diff --git a/bin/docker_detection_tester/modules/testing_service.py b/bin/docker_detection_tester/modules/testing_service.py index ac022d3b6a..cccd0750e1 100644 --- a/bin/docker_detection_tester/modules/testing_service.py +++ b/bin/docker_detection_tester/modules/testing_service.py @@ -48,9 +48,8 @@ def test_detection_wrapper(container_name:str, splunk_ip:str, splunk_password:st else: wait_on_delete = None - for index_to_delete in indices_to_delete: - print(f"Deleting index data for {test_file}: {index_to_delete}") - splunk_sdk.delete_attack_data(splunk_ip, splunk_password, splunk_port, wait_on_delete, search_string, test_file, index = index_to_delete) + + splunk_sdk.delete_attack_data(splunk_ip, splunk_password, splunk_port, wait_on_delete, search_string, test_file, indices = indices_to_delete return result_test From 1e9b95542de3e23eb55eccfcbe411ed078721d56 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 8 Jun 2022 15:30:49 -0700 Subject: [PATCH 109/148] Missing parenthesis added --- bin/docker_detection_tester/modules/testing_service.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/docker_detection_tester/modules/testing_service.py b/bin/docker_detection_tester/modules/testing_service.py index cccd0750e1..00fd03d3e8 100644 --- a/bin/docker_detection_tester/modules/testing_service.py +++ b/bin/docker_detection_tester/modules/testing_service.py @@ -49,7 +49,7 @@ def test_detection_wrapper(container_name:str, splunk_ip:str, splunk_password:st wait_on_delete = None - splunk_sdk.delete_attack_data(splunk_ip, splunk_password, splunk_port, wait_on_delete, search_string, test_file, indices = indices_to_delete + splunk_sdk.delete_attack_data(splunk_ip, splunk_password, splunk_port, wait_on_delete, search_string, test_file, indices = indices_to_delete) return result_test From b87dff2883cde8607cf073fb4e9c66cba80e3e41 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 8 Jun 2022 16:01:21 -0700 Subject: [PATCH 110/148] Fixing name field in a detection test file --- ...k_protocol_impersonation_weak_encryption_selfsigned.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml b/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml index d97cf683a0..fb97c5ec66 100644 --- a/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml +++ b/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml @@ -1,6 +1,6 @@ name: Splunk protocol impersonation weak encryption selfsigned Unit Test tests: -- name: Splunk protocol impersonation weak encryption simplerequest +- name: Splunk protocol impersonation weak encryption selfsigned file: application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h From c5386131392da3dd8a0f6a2e9cac8c7f00f88039 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 8 Jun 2022 16:47:56 -0700 Subject: [PATCH 111/148] wrong detection file linked from test file. Fixed. --- ...k_protocol_impersonation_weak_encryption_selfsigned.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml b/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml index fb97c5ec66..4108a9dd4c 100644 --- a/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml +++ b/tests/application/splunk_protocol_impersonation_weak_encryption_selfsigned.test.yml @@ -1,7 +1,7 @@ name: Splunk protocol impersonation weak encryption selfsigned Unit Test tests: - name: Splunk protocol impersonation weak encryption selfsigned - file: application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml + file: application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now From 6efcbd4b93c88f29ead032ee7080eda0c1ac5825 Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Mon, 13 Jun 2022 09:50:58 -0700 Subject: [PATCH 112/148] add risky command ML detection --- ...ky_command_abuse_ml_detection_baseline.yml | 71 +++++++++++++++++++ ...plunk_risky_command_abuse_ml_detection.yml | 67 +++++++++++++++++ ..._risky_command_abuse_ml_detection.test.yml | 20 ++++++ 3 files changed, 158 insertions(+) create mode 100644 baselines/splunk_risky_command_abuse_ml_detection_baseline.yml create mode 100644 detections/application/splunk_risky_command_abuse_ml_detection.yml create mode 100644 tests/application/splunk_risky_command_abuse_ml_detection.test.yml diff --git a/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml b/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml new file mode 100644 index 0000000000..4175681ff2 --- /dev/null +++ b/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml @@ -0,0 +1,71 @@ +name: Splunk Risky Command Abuse ML Detection Baseline +id: 273df2f7-643a-451a-8d4d-637e39eadc87 +version: 1 +date: '2022-05-27' +author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk +type: Baseline +datamodel: +- Splunk_Audit +description: 'This search is to build a per user risky command abuse detection model using MLTK DensityFunction + algorithm based on audit log data of Splunk apps. The model is built from past 7 days users history of running + search commands containing risky keywords, and aggregate the total search run time for each hour as indicator of + user behavior. The default threshold of outlier boundary is defined as 0.1%. This search should be scheduled to + run at least as frequently as every 7 days to build a recent baseline for each user. The name of ML model + generated is "risky_command_abuse" and should be configured as global (not private) in MLTK app, unless the same + account of training this model will be used to perfeorm inference using this model for anomaly detection. + The corresponding detection of using this model is "Splunk Risky Command Abuse ML Detection". ' +search: '| tstats values(Search_Activity.user) as user, sum(Search_Activity.total_run_time) as run_time count + FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") + AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now) + AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", + "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) + AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) + BY _time, Search_Activity.user span=1h + | fit DensityFunction "run_time" dist=auto threshold=0.001 show_density=true by "user" into "risky_command_abuse" ' +how_to_implement: This detection depends on MLTK and assumes Splunk audit data model is available. + For large enterprises, training the model might take significant computing resources, and might + need to incresase MLTK DensityFunction settings default values, such as max_fit_time, max_groups, etc. +known_false_positives: Benigh search of long run time will be flagged as positive (false), if the run time of + a search exceeds the boundaries of outlier defined by the fitted density function model. +references: +- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Web Server + cis20: + - CIS 3 + - CIS 6 + confidence: 40 + context: + - Source:Endpoint + dataset: + - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt + impact: 50 + kill_chain_phases: + - Actions on Objectives + message: ML model "risky_command_abuse" training is completed. + mitre_attack_id: + - T1203 + nist: + - DE.AE + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Search_Activity.search + - Search_Activity.total_run_time + - Search_Activity.user + - Search_Activity.search_type + risk_score: 20 + security_domain: audit + detections: + - Splunk Risky Command Abuse ML Detection + diff --git a/detections/application/splunk_risky_command_abuse_ml_detection.yml b/detections/application/splunk_risky_command_abuse_ml_detection.yml new file mode 100644 index 0000000000..709d3b7182 --- /dev/null +++ b/detections/application/splunk_risky_command_abuse_ml_detection.yml @@ -0,0 +1,67 @@ +name: Splunk Risky Command Abuse ML Detection +id: 19d0146c-2eae-4e53-8d39-1198a78fa9ca +version: 1 +date: '2022-05-27' +author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk +type: Anomaly +datamodel: +- Splunk_Audit +description: 'This detection utilize machine learning model named "risky_command_abuse" trained from "Splunk + Risky Command Abuse ML Model Baseline". It should be scheduled to run every hour + to detect whether a user has run searches containing risky keywords with abnormal long running time in the + past two hours, comparing with his/her past seven days history. ' +search: '| tstats values(Search_Activity.user) AS user, sum(Search_Activity.total_run_time) AS run_time, + values(Search_Activity.search) as searches, count + FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") + AND (Search_Activity.total_run_time>1) AND (earliest=-2h@h latest=now) + AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", + "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) + AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) + BY _time, Search_Activity.user span=1h + | apply risky_command_abuse + | fields _time, user, searches, run_time, IsOutlier(run_time) + | rename IsOutlier(run_time) as isOutlier, _time as timestamp + | where isOutlier>0.5 | `splunk_risky_command_abuse_ml_detection_filter`' +how_to_implement: This detection depends on MLTK and assumes Splunk audit data model is available. +known_false_positives: Benigh search of long run time will be flagged as positive (false), if the run time of + a search exceeds the boundaries of outlier defined by the fitted density function model. +references: +- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Web Server + cis20: + - CIS 3 + - CIS 6 + confidence: 40 + context: + - Source:Endpoint + dataset: + - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt + impact: 50 + kill_chain_phases: + - Actions on Objectives + message: $user used abnormally long run time for searches with risky command. + mitre_attack_id: + - T1203 + nist: + - DE.AE + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Search_Activity.search + - Search_Activity.total_run_time + - Search_Activity.user + - Search_Activity.search_type + risk_score: 20 + security_domain: audit + \ No newline at end of file diff --git a/tests/application/splunk_risky_command_abuse_ml_detection.test.yml b/tests/application/splunk_risky_command_abuse_ml_detection.test.yml new file mode 100644 index 0000000000..c937b44717 --- /dev/null +++ b/tests/application/splunk_risky_command_abuse_ml_detection.test.yml @@ -0,0 +1,20 @@ +name: Splunk Risky Command Abuse ML Detection Unit Test +tests: +- name: Splunk Risky Command Abuse ML Detection + file: application/splunk_risky_command_abuse_ml_detection.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -1h + latest_time: now + baselines: + - name: Splunk Risky Command Abuse ML Detection Baseline + file: baselines/splunk_risky_command_abuse_ml_detection_baseline.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -7d + latest_time: now + attack_data: + - file_name: search_activity.json + data: https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt + source: audittrail + sourcetype: audittrail + update_timestamp: true + custom_index: _audit From 3369d15d72ed75079b4b0e41ecc15d9f4bd2f070 Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Mon, 13 Jun 2022 10:40:47 -0700 Subject: [PATCH 113/148] rm wrong commit --- ...ky_command_abuse_ml_detection_baseline.yml | 71 ------------------- ...plunk_risky_command_abuse_ml_detection.yml | 67 ----------------- ..._risky_command_abuse_ml_detection.test.yml | 20 ------ 3 files changed, 158 deletions(-) delete mode 100644 baselines/splunk_risky_command_abuse_ml_detection_baseline.yml delete mode 100644 detections/application/splunk_risky_command_abuse_ml_detection.yml delete mode 100644 tests/application/splunk_risky_command_abuse_ml_detection.test.yml diff --git a/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml b/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml deleted file mode 100644 index 4175681ff2..0000000000 --- a/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Splunk Risky Command Abuse ML Detection Baseline -id: 273df2f7-643a-451a-8d4d-637e39eadc87 -version: 1 -date: '2022-05-27' -author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk -type: Baseline -datamodel: -- Splunk_Audit -description: 'This search is to build a per user risky command abuse detection model using MLTK DensityFunction - algorithm based on audit log data of Splunk apps. The model is built from past 7 days users history of running - search commands containing risky keywords, and aggregate the total search run time for each hour as indicator of - user behavior. The default threshold of outlier boundary is defined as 0.1%. This search should be scheduled to - run at least as frequently as every 7 days to build a recent baseline for each user. The name of ML model - generated is "risky_command_abuse" and should be configured as global (not private) in MLTK app, unless the same - account of training this model will be used to perfeorm inference using this model for anomaly detection. - The corresponding detection of using this model is "Splunk Risky Command Abuse ML Detection". ' -search: '| tstats values(Search_Activity.user) as user, sum(Search_Activity.total_run_time) as run_time count - FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") - AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now) - AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", - "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) - AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) - BY _time, Search_Activity.user span=1h - | fit DensityFunction "run_time" dist=auto threshold=0.001 show_density=true by "user" into "risky_command_abuse" ' -how_to_implement: This detection depends on MLTK and assumes Splunk audit data model is available. - For large enterprises, training the model might take significant computing resources, and might - need to incresase MLTK DensityFunction settings default values, such as max_fit_time, max_groups, etc. -known_false_positives: Benigh search of long run time will be flagged as positive (false), if the run time of - a search exceeds the boundaries of outlier defined by the fitted density function model. -references: -- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Web Server - cis20: - - CIS 3 - - CIS 6 - confidence: 40 - context: - - Source:Endpoint - dataset: - - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt - impact: 50 - kill_chain_phases: - - Actions on Objectives - message: ML model "risky_command_abuse" training is completed. - mitre_attack_id: - - T1203 - nist: - - DE.AE - observable: - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Search_Activity.search - - Search_Activity.total_run_time - - Search_Activity.user - - Search_Activity.search_type - risk_score: 20 - security_domain: audit - detections: - - Splunk Risky Command Abuse ML Detection - diff --git a/detections/application/splunk_risky_command_abuse_ml_detection.yml b/detections/application/splunk_risky_command_abuse_ml_detection.yml deleted file mode 100644 index 709d3b7182..0000000000 --- a/detections/application/splunk_risky_command_abuse_ml_detection.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Splunk Risky Command Abuse ML Detection -id: 19d0146c-2eae-4e53-8d39-1198a78fa9ca -version: 1 -date: '2022-05-27' -author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk -type: Anomaly -datamodel: -- Splunk_Audit -description: 'This detection utilize machine learning model named "risky_command_abuse" trained from "Splunk - Risky Command Abuse ML Model Baseline". It should be scheduled to run every hour - to detect whether a user has run searches containing risky keywords with abnormal long running time in the - past two hours, comparing with his/her past seven days history. ' -search: '| tstats values(Search_Activity.user) AS user, sum(Search_Activity.total_run_time) AS run_time, - values(Search_Activity.search) as searches, count - FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") - AND (Search_Activity.total_run_time>1) AND (earliest=-2h@h latest=now) - AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", - "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) - AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) - BY _time, Search_Activity.user span=1h - | apply risky_command_abuse - | fields _time, user, searches, run_time, IsOutlier(run_time) - | rename IsOutlier(run_time) as isOutlier, _time as timestamp - | where isOutlier>0.5 | `splunk_risky_command_abuse_ml_detection_filter`' -how_to_implement: This detection depends on MLTK and assumes Splunk audit data model is available. -known_false_positives: Benigh search of long run time will be flagged as positive (false), if the run time of - a search exceeds the boundaries of outlier defined by the fitted density function model. -references: -- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Web Server - cis20: - - CIS 3 - - CIS 6 - confidence: 40 - context: - - Source:Endpoint - dataset: - - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt - impact: 50 - kill_chain_phases: - - Actions on Objectives - message: $user used abnormally long run time for searches with risky command. - mitre_attack_id: - - T1203 - nist: - - DE.AE - observable: - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Search_Activity.search - - Search_Activity.total_run_time - - Search_Activity.user - - Search_Activity.search_type - risk_score: 20 - security_domain: audit - \ No newline at end of file diff --git a/tests/application/splunk_risky_command_abuse_ml_detection.test.yml b/tests/application/splunk_risky_command_abuse_ml_detection.test.yml deleted file mode 100644 index c937b44717..0000000000 --- a/tests/application/splunk_risky_command_abuse_ml_detection.test.yml +++ /dev/null @@ -1,20 +0,0 @@ -name: Splunk Risky Command Abuse ML Detection Unit Test -tests: -- name: Splunk Risky Command Abuse ML Detection - file: application/splunk_risky_command_abuse_ml_detection.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -1h - latest_time: now - baselines: - - name: Splunk Risky Command Abuse ML Detection Baseline - file: baselines/splunk_risky_command_abuse_ml_detection_baseline.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -7d - latest_time: now - attack_data: - - file_name: search_activity.json - data: https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt - source: audittrail - sourcetype: audittrail - update_timestamp: true - custom_index: _audit From 5a34e6c63309b19b7b17a394eb451b5dfe0b2b26 Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Mon, 13 Jun 2022 10:53:09 -0700 Subject: [PATCH 114/148] add risky command abuse ML detection --- ...ky_command_abuse_ml_detection_baseline.yml | 71 +++++++++++++++++++ ...plunk_risky_command_abuse_ml_detection.yml | 67 +++++++++++++++++ ..._risky_command_abuse_ml_detection.test.yml | 20 ++++++ 3 files changed, 158 insertions(+) create mode 100644 baselines/splunk_risky_command_abuse_ml_detection_baseline.yml create mode 100644 detections/application/splunk_risky_command_abuse_ml_detection.yml create mode 100644 tests/application/splunk_risky_command_abuse_ml_detection.test.yml diff --git a/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml b/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml new file mode 100644 index 0000000000..4175681ff2 --- /dev/null +++ b/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml @@ -0,0 +1,71 @@ +name: Splunk Risky Command Abuse ML Detection Baseline +id: 273df2f7-643a-451a-8d4d-637e39eadc87 +version: 1 +date: '2022-05-27' +author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk +type: Baseline +datamodel: +- Splunk_Audit +description: 'This search is to build a per user risky command abuse detection model using MLTK DensityFunction + algorithm based on audit log data of Splunk apps. The model is built from past 7 days users history of running + search commands containing risky keywords, and aggregate the total search run time for each hour as indicator of + user behavior. The default threshold of outlier boundary is defined as 0.1%. This search should be scheduled to + run at least as frequently as every 7 days to build a recent baseline for each user. The name of ML model + generated is "risky_command_abuse" and should be configured as global (not private) in MLTK app, unless the same + account of training this model will be used to perfeorm inference using this model for anomaly detection. + The corresponding detection of using this model is "Splunk Risky Command Abuse ML Detection". ' +search: '| tstats values(Search_Activity.user) as user, sum(Search_Activity.total_run_time) as run_time count + FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") + AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now) + AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", + "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) + AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) + BY _time, Search_Activity.user span=1h + | fit DensityFunction "run_time" dist=auto threshold=0.001 show_density=true by "user" into "risky_command_abuse" ' +how_to_implement: This detection depends on MLTK and assumes Splunk audit data model is available. + For large enterprises, training the model might take significant computing resources, and might + need to incresase MLTK DensityFunction settings default values, such as max_fit_time, max_groups, etc. +known_false_positives: Benigh search of long run time will be flagged as positive (false), if the run time of + a search exceeds the boundaries of outlier defined by the fitted density function model. +references: +- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Web Server + cis20: + - CIS 3 + - CIS 6 + confidence: 40 + context: + - Source:Endpoint + dataset: + - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt + impact: 50 + kill_chain_phases: + - Actions on Objectives + message: ML model "risky_command_abuse" training is completed. + mitre_attack_id: + - T1203 + nist: + - DE.AE + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Search_Activity.search + - Search_Activity.total_run_time + - Search_Activity.user + - Search_Activity.search_type + risk_score: 20 + security_domain: audit + detections: + - Splunk Risky Command Abuse ML Detection + diff --git a/detections/application/splunk_risky_command_abuse_ml_detection.yml b/detections/application/splunk_risky_command_abuse_ml_detection.yml new file mode 100644 index 0000000000..709d3b7182 --- /dev/null +++ b/detections/application/splunk_risky_command_abuse_ml_detection.yml @@ -0,0 +1,67 @@ +name: Splunk Risky Command Abuse ML Detection +id: 19d0146c-2eae-4e53-8d39-1198a78fa9ca +version: 1 +date: '2022-05-27' +author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk +type: Anomaly +datamodel: +- Splunk_Audit +description: 'This detection utilize machine learning model named "risky_command_abuse" trained from "Splunk + Risky Command Abuse ML Model Baseline". It should be scheduled to run every hour + to detect whether a user has run searches containing risky keywords with abnormal long running time in the + past two hours, comparing with his/her past seven days history. ' +search: '| tstats values(Search_Activity.user) AS user, sum(Search_Activity.total_run_time) AS run_time, + values(Search_Activity.search) as searches, count + FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") + AND (Search_Activity.total_run_time>1) AND (earliest=-2h@h latest=now) + AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", + "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) + AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) + BY _time, Search_Activity.user span=1h + | apply risky_command_abuse + | fields _time, user, searches, run_time, IsOutlier(run_time) + | rename IsOutlier(run_time) as isOutlier, _time as timestamp + | where isOutlier>0.5 | `splunk_risky_command_abuse_ml_detection_filter`' +how_to_implement: This detection depends on MLTK and assumes Splunk audit data model is available. +known_false_positives: Benigh search of long run time will be flagged as positive (false), if the run time of + a search exceeds the boundaries of outlier defined by the fitted density function model. +references: +- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Web Server + cis20: + - CIS 3 + - CIS 6 + confidence: 40 + context: + - Source:Endpoint + dataset: + - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt + impact: 50 + kill_chain_phases: + - Actions on Objectives + message: $user used abnormally long run time for searches with risky command. + mitre_attack_id: + - T1203 + nist: + - DE.AE + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Search_Activity.search + - Search_Activity.total_run_time + - Search_Activity.user + - Search_Activity.search_type + risk_score: 20 + security_domain: audit + \ No newline at end of file diff --git a/tests/application/splunk_risky_command_abuse_ml_detection.test.yml b/tests/application/splunk_risky_command_abuse_ml_detection.test.yml new file mode 100644 index 0000000000..c937b44717 --- /dev/null +++ b/tests/application/splunk_risky_command_abuse_ml_detection.test.yml @@ -0,0 +1,20 @@ +name: Splunk Risky Command Abuse ML Detection Unit Test +tests: +- name: Splunk Risky Command Abuse ML Detection + file: application/splunk_risky_command_abuse_ml_detection.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -1h + latest_time: now + baselines: + - name: Splunk Risky Command Abuse ML Detection Baseline + file: baselines/splunk_risky_command_abuse_ml_detection_baseline.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -7d + latest_time: now + attack_data: + - file_name: search_activity.json + data: https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt + source: audittrail + sourcetype: audittrail + update_timestamp: true + custom_index: _audit From cc852767f76d2ef701d757459224dedbeaef3b0a Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 13 Jun 2022 14:04:04 -0500 Subject: [PATCH 115/148] Updated date --- .../splunk_digital_certificates_lack_of_encryption.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_digital_certificates_lack_of_encryption.yml b/detections/application/splunk_digital_certificates_lack_of_encryption.yml index b156555281..10b62666c5 100644 --- a/detections/application/splunk_digital_certificates_lack_of_encryption.yml +++ b/detections/application/splunk_digital_certificates_lack_of_encryption.yml @@ -5,7 +5,7 @@ date: '2022-05-26' author: Lou Stella, Splunk type: Anomaly datamodel: [] -description: On June 10th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. The fixes for these require upgrading to at least Splunk 9.0 on the forwarder as well. This is a great opportunity to configure TLS across the environment. This search looks for forwarders that are not using TLS and adds risk to those entities. +description: On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. The fixes for these require upgrading to at least Splunk 9.0 on the forwarder as well. This is a great opportunity to configure TLS across the environment. This search looks for forwarders that are not using TLS and adds risk to those entities. search: '`splunkd` group="tcpin_connections" ssl="false" | stats values(sourceIp) latest(fwdType) latest(version) by hostname | `splunk_digital_certificates_lack_of_encryption_filter`' how_to_implement: This anomaly search looks for forwarder connections that are not currently using TLS. It then presents the source IP, the type of forwarder, and the version of the forwarder. You can also remove the "ssl=false" argument from the initial stanza in order to get a full list of all your forwarders that are sending data, and the version of Splunk software they are running, for audit purposes. known_false_positives: None at this time From 41db7931fd39dc76e6e1f52cfe6c276237710fd6 Mon Sep 17 00:00:00 2001 From: d1vious Date: Mon, 13 Jun 2022 16:05:21 -0400 Subject: [PATCH 116/148] removing notebooks --- ...ntial_dump_from_registry_via_reg_exe.ipynb | 141 -- ...oders_for_unusual_group_of_processes.ipynb | 317 --- ..._dump_lsass.exe_memory_using_comsvcs.ipynb | 179 -- notebooks/detect_kerberoasting__ssa.ipynb | 143 -- notebooks/detect_pass_hash__ssa.ipynb | 159 -- notebooks/phishing_detection_unit_test.ipynb | 222 -- ...e_parent_process_relationship_lolbas.ipynb | 330 --- notebooks/ssa___CredentialExtraction.ipynb | 1828 ----------------- ...ain_and_publish_phishing_email_model.ipynb | 564 ----- ...t_prohibited_apps_spawning_cmdprompt.ipynb | 204 -- ...usual_lolbas_in_short_period_of_time.ipynb | 268 --- 11 files changed, 4355 deletions(-) delete mode 100644 notebooks/attempted_credential_dump_from_registry_via_reg_exe.ipynb delete mode 100644 notebooks/autoencoders_for_unusual_group_of_processes.ipynb delete mode 100644 notebooks/detect_dump_lsass.exe_memory_using_comsvcs.ipynb delete mode 100644 notebooks/detect_kerberoasting__ssa.ipynb delete mode 100644 notebooks/detect_pass_hash__ssa.ipynb delete mode 100644 notebooks/phishing_detection_unit_test.ipynb delete mode 100644 notebooks/rare_parent_process_relationship_lolbas.ipynb delete mode 100644 notebooks/ssa___CredentialExtraction.ipynb delete mode 100644 notebooks/train_and_publish_phishing_email_model.ipynb delete mode 100644 notebooks/unit_test_prohibited_apps_spawning_cmdprompt.ipynb delete mode 100644 notebooks/unusual_lolbas_in_short_period_of_time.ipynb diff --git a/notebooks/attempted_credential_dump_from_registry_via_reg_exe.ipynb b/notebooks/attempted_credential_dump_from_registry_via_reg_exe.ipynb deleted file mode 100644 index 49c3f18b14..0000000000 --- a/notebooks/attempted_credential_dump_from_registry_via_reg_exe.ipynb +++ /dev/null @@ -1,141 +0,0 @@ -{ - "cells": [ - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "## Detect Credential Dumping via reg.exe T1003.002" - ] - }, - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the net user command. Enumerating the SAM database requires SYSTEM level access. MITRE ATT&CK" - ] - }, - { - "cell_type": "code", - "execution_count": 1, - "metadata": { - "execution": { - "iopub.status.idle": "2020-10-19T19:55:18.824958Z", - "shell.execute_reply": "2020-10-19T19:55:18.824476Z", - "shell.execute_reply.started": "2020-10-19T19:55:15.531094Z" - }, - "scrolled": true - }, - "outputs": [ - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
sysmoncmd_linevalueprocess_name
0{'EventTime': '2020-06-30 10:47:11', 'Hostname...\"C:\\Windows\\system32\\cmd.exe\" /c \"reg save HKL...{\"EventTime\":\"2020-06-30 10:47:11\",\"Hostname\":...C:\\Windows\\System32\\cmd.exe
\n", - "
" - ], - "text/plain": [ - " sysmon ... process_name\n", - "0 {'EventTime': '2020-06-30 10:47:11', 'Hostname... ... C:\\Windows\\System32\\cmd.exe\n", - "\n", - "[1 rows x 4 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 1, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2\n", - "/* read attack dataset generated by Splunk Attack Range */\n", - "| from read_text(\"s3://smle-experiments/datasets/attack-range/T1003.002/attack_data.txt\")\n", - "/* cast data as JSON */\n", - "| eval sysmon=from_json_object(cast(value, \"string\"))\n", - "/* read in the process name */\n", - "| eval process_name=ucast(map_get(sysmon, \"Image\"), \"string\", \"\") \n", - "/* filter on cmd.exe and reg.exe */\n", - "| where process_name LIKE \"%cmd.exe%\" OR process_name=\"%reg.exe%\"\n", - "/* read in the process name */\n", - "| eval cmd_line=ucast(map_get(sysmon, \"CommandLine\"), \"string\", \"\") \n", - "/* filter by any command line string that has the word save and matches targetted registry */\n", - "| where cmd_line != null AND \n", - " match_regex(cmd_line, /(?i)save\\s+/)=true AND\n", - " ( match_regex(cmd_line, /(?i)HKLM\\\\Security/)=true OR\n", - " match_regex(cmd_line, /(?i)HKLM\\\\SAM/)=true OR\n", - " match_regex(cmd_line, /(?i)HKLM\\\\System/)=true OR\n", - " match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\\\Security/)=true OR\n", - " match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\\\SAM/)=true OR\n", - " match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\\\System/)=true \n", - " );" - ] - } - ], - "metadata": { - "kernelspec": { - "display_name": "SPL2", - "language": "SPL", - "name": "spl2" - }, - "language_info": { - "mimetype": "text/spl", - "name": "SPL" - } - }, - "nbformat": 4, - "nbformat_minor": 4 -} diff --git a/notebooks/autoencoders_for_unusual_group_of_processes.ipynb b/notebooks/autoencoders_for_unusual_group_of_processes.ipynb deleted file mode 100644 index 1f595d1ce8..0000000000 --- a/notebooks/autoencoders_for_unusual_group_of_processes.ipynb +++ /dev/null @@ -1,317 +0,0 @@ -{ - "cells": [ - { - "cell_type": "markdown", - "id": "3c1c8020-a12c-49ca-bbe6-4cedd473f48a", - "metadata": {}, - "source": [ - "## AutoEncoders to detect unusual groups of processes\n", - "\n", - "This notebook provides a reference we use for training [autoencoders](https://en.wikipedia.org/wiki/Autoencoder) to perform anomaly detection. Autoencoders are neural networks that attempt to faithfully reconstruct its input by first compressing it into a low dimensional encoding and then decompressing that encoding. These networks can be useful for anomaly detection because unusual data will have poor reconstructions. For cybersecurity, we can leverage anomaly detection to find possible attacks without having to perform significant feature engineering.\n", - "\n", - "
\n", - "\n", - "

Diagram by Michaela Massi, some rights reserved

\n", - "
\n", - "\n", - "For our purposes, we will build an autoencoder to identify anomalous groups of processes. We focus on processes with the prefix \\\\\\\\device\\Windows since attackers leverage these executables to [live off the land](https://conf.splunk.com/files/2019/slides/SEC1375.pdf). We use a technique called [feature hashing](https://scikit-learn.org/stable/modules/generated/sklearn.feature_extraction.FeatureHasher.html) to project the input (a map of process -> counts) into a [vector space](https://en.wikipedia.org/wiki/Vector_space) (convenient for machine learning).\n" - ] - }, - { - "cell_type": "code", - "execution_count": 8, - "id": "243c11af-0f58-4bb7-9bc6-1a0a88df8abe", - "metadata": {}, - "outputs": [], - "source": [ - "import numpy as np\n", - "from sklearn.feature_extraction import FeatureHasher\n", - "import tensorflow as tf\n", - "from sklearn.pipeline import Pipeline\n" - ] - }, - { - "cell_type": "markdown", - "id": "151ade38-3b59-482c-80f4-688f04cb2cf8", - "metadata": {}, - "source": [ - "### Training data\n", - "We will create a toy dataset that will contain which processes launched and how often during some time window (e.g. hour) correllated on one or more entities (e.g. user and machine, machine). For this demonstration, normal data will consist of a sample of four processes, of which, these four processes can occur 0-5 times within a sampling period. We assume independence between the processes. The below code block generates the data." - ] - }, - { - "cell_type": "code", - "execution_count": 38, - "id": "c17980df-e29a-4696-8b35-fa440864306f", - "metadata": {}, - "outputs": [], - "source": [ - "# Let's create some dummy data using processes\n", - "# commonly seen with the prefix C:\\Windows\n", - "num_samples = 10000\n", - "def create_dataset(num_samples=10000):\n", - " data = []\n", - " for i in range(num_samples):\n", - " datum = {'cmd.exe': np.round(np.random.uniform(high=5)),\n", - " 'conhost.exe': np.round(np.random.uniform(high=5)),\n", - " 'svchost.exe': np.round(np.random.uniform(high=5)),\n", - " 'werfault.exe': np.round(np.random.uniform(high=5))}\n", - " data.append(datum)\n", - " return data\n", - "\n", - "training_data = create_dataset()\n", - "test_data = create_dataset()\n" - ] - }, - { - "cell_type": "markdown", - "id": "2e5a163c-7f91-468f-bdb3-5c14a244945f", - "metadata": {}, - "source": [ - "### Transforming the data\n", - "We use a scikit learn pipeline to feature hash the input into a 16 dimensional vector. An example is shown of what the input and output look like." - ] - }, - { - "cell_type": "code", - "execution_count": 59, - "id": "63ca8129-0e0c-43c2-9ee6-b25c0a83390f", - "metadata": {}, - "outputs": [ - { - "name": "stdout", - "output_type": "stream", - "text": [ - "Input data (process -> count map):\n", - "cmd.exe->3, conhost.exe->3, svchost.exe->5, werfault.exe->0\n", - "\n", - "\n", - "Vectorized input (16 dimensional)\n", - "[[-3. 2. 0. 0. 0. 0. 0. 0. 0. 0. 0. 0. 0. 0. 0. 0.]]\n" - ] - } - ], - "source": [ - "pipe = Pipeline([('hasher', FeatureHasher(n_features=16))])\n", - "X = pipe.fit_transform(data)\n", - "\n", - "print(\"Input data (process -> count map):\")\n", - "print(\", \".join([f\"{k}->{int(v)}\" for (k, v) in data[0].items()]))\n", - "print(\"\\n\")\n", - "print(\"Vectorized input (16 dimensional)\")\n", - "print(X[0].todense())" - ] - }, - { - "cell_type": "markdown", - "id": "a941fd31-cb58-407d-b8bc-caea2229bb35", - "metadata": {}, - "source": [ - "## Network\n", - "We build our model using TensorFlow Keras. Since the input is already vectorized, we will stack vanilla dense layers with leaky ReLU activations to compress the input into a four dimensional vector encoding and than decompress back into the original." - ] - }, - { - "cell_type": "code", - "execution_count": 55, - "id": "05f287e6-4f5b-454e-8aa0-2d18f4c07612", - "metadata": {}, - "outputs": [ - { - "name": "stdout", - "output_type": "stream", - "text": [ - "Model: \"model_2\"\n", - "_________________________________________________________________\n", - "Layer (type) Output Shape Param # \n", - "=================================================================\n", - "win_processes_hashed (InputL [(None, 16)] 0 \n", - "_________________________________________________________________\n", - "enc_1 (Dense) (None, 8) 136 \n", - "_________________________________________________________________\n", - "leaky_re_lu_8 (LeakyReLU) (None, 8) 0 \n", - "_________________________________________________________________\n", - "enc_2 (Dense) (None, 4) 36 \n", - "_________________________________________________________________\n", - "leaky_re_lu_9 (LeakyReLU) (None, 4) 0 \n", - "_________________________________________________________________\n", - "dec_1 (Dense) (None, 8) 40 \n", - "_________________________________________________________________\n", - "leaky_re_lu_10 (LeakyReLU) (None, 8) 0 \n", - "_________________________________________________________________\n", - "reconstruction (Dense) (None, 16) 144 \n", - "_________________________________________________________________\n", - "leaky_re_lu_11 (LeakyReLU) (None, 16) 0 \n", - "=================================================================\n", - "Total params: 356\n", - "Trainable params: 356\n", - "Non-trainable params: 0\n", - "_________________________________________________________________\n" - ] - } - ], - "source": [ - "ae_input_layer = tf.keras.layers.Input(shape=(16,), name=\"win_processes_hashed\")\n", - "ae_net = tf.keras.layers.Dense(8, name=\"enc_1\")(ae_input_layer)\n", - "ae_net = tf.keras.layers.LeakyReLU()(ae_net)\n", - "ae_net = tf.keras.layers.Dense(4, name=\"enc_2\")(ae_net)\n", - "ae_net = tf.keras.layers.LeakyReLU()(ae_net)\n", - "ae_net = tf.keras.layers.Dense(8, name=\"dec_1\")(ae_net)\n", - "ae_net = tf.keras.layers.LeakyReLU()(ae_net)\n", - "ae_net = tf.keras.layers.Dense(16, name=\"reconstruction\")(ae_net)\n", - "ae_net = tf.keras.layers.LeakyReLU()(ae_net)\n", - "ae_model = tf.keras.models.Model(ae_input_layer, ae_net)\n", - "ae_model.compile('adam', 'mse', ['mae'])\n", - "ae_model.summary()" - ] - }, - { - "cell_type": "code", - "execution_count": 56, - "id": "056ebac9-a317-4840-af1b-acfb2126f8be", - "metadata": {}, - "outputs": [ - { - "name": "stdout", - "output_type": "stream", - "text": [ - "Epoch 1/10\n", - "1250/1250 [==============================] - 1s 549us/step - loss: 0.7084 - mae: 0.2522\n", - "Epoch 2/10\n", - "1250/1250 [==============================] - 1s 587us/step - loss: 0.0053 - mae: 0.0334\n", - "Epoch 3/10\n", - "1250/1250 [==============================] - 1s 550us/step - loss: 0.0012 - mae: 0.0171\n", - "Epoch 4/10\n", - "1250/1250 [==============================] - 1s 519us/step - loss: 4.5895e-04 - mae: 0.0092\n", - "Epoch 5/10\n", - "1250/1250 [==============================] - 1s 554us/step - loss: 1.9394e-04 - mae: 0.0063\n", - "Epoch 6/10\n", - "1250/1250 [==============================] - 1s 575us/step - loss: 1.0455e-04 - mae: 0.0047\n", - "Epoch 7/10\n", - "1250/1250 [==============================] - 1s 543us/step - loss: 6.1987e-05 - mae: 0.0038\n", - "Epoch 8/10\n", - "1250/1250 [==============================] - 1s 556us/step - loss: 3.1945e-05 - mae: 0.0030\n", - "Epoch 9/10\n", - "1250/1250 [==============================] - 1s 571us/step - loss: 2.4396e-05 - mae: 0.0028\n", - "Epoch 10/10\n", - "1250/1250 [==============================] - 1s 562us/step - loss: 2.3492e-05 - mae: 0.0027\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 56, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "# Training\n", - "ae_model.fit(X, X.todense(), epochs=10, batch_size=8)" - ] - }, - { - "cell_type": "markdown", - "id": "90dfef32-7da8-40d5-98ca-bf85b98f08ae", - "metadata": {}, - "source": [ - "### Anomaly detection\n", - "We use euclidean distance as a similarity function between the input and reconstruction. We expect that the distance between reconstruction and input will be small for normal data and large for anomalous data.\n", - "\n", - "First we apply the model and get the mean distance to the test data (which is generated the same way as the training data). We expect this to be small and it is." - ] - }, - { - "cell_type": "code", - "execution_count": 57, - "id": "01f81d20-aa84-4814-bf4b-ccc7f7e26dbe", - "metadata": {}, - "outputs": [ - { - "data": { - "text/plain": [ - "0.010183748708750814" - ] - }, - "execution_count": 57, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "X_test = pipe.transform(test_data)\n", - "np.average(np.sqrt(np.sum(np.square(X_test - ae_model.predict(X_test)), axis=1)))" - ] - }, - { - "cell_type": "markdown", - "id": "078db0c1-5313-452b-bdf9-984c5c2a7359", - "metadata": {}, - "source": [ - "Now let's apply the model to an unusual command that might be seen with [discovery](https://attack.mitre.org/tactics/TA0007/). Typically, we may see at most one of these processes in a sampling window. Notice how much larger the distance between the anomalous reconstruction and the mean normal reconstruction. Therefore, we can call out this unusual collection of processes in a short period of time to an analyst to get a disposition if this behavior is malicious. We may also call out this activity if there are other secondary or weakly predictive signals related to the same user or device." - ] - }, - { - "cell_type": "code", - "execution_count": 58, - "id": "5b27ab39-e1c3-4847-a90f-be3a03fb4e10", - "metadata": {}, - "outputs": [ - { - "data": { - "text/plain": [ - "5.716755530643157" - ] - }, - "execution_count": 58, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "unusual_command = [{\n", - " 'whoami.exe': 1,\n", - " 'net.exe': 3,\n", - " 'ver.exe': 1,\n", - " 'query.exe': 2,\n", - " 'sc.exe': 5}\n", - "]\n", - "X_u = pipe.transform(unusual_commands)\n", - "np.sqrt(np.sum(np.square(X_u - ae_model.predict(X_u))))" - ] - }, - { - "cell_type": "markdown", - "id": "9adfec39-e05d-417d-9a7a-a80b1e34a538", - "metadata": {}, - "source": [ - "### Summary\n", - "Cybersecurity has long employed anomaly detection to identify unusual activity that may be attributable to cyber attacks. This notebook shows how autoencoders, a deep neural network, can take a map of process counts during a sampling window and identify unusual groups. To accomplish this, we use feature hashing to vectorize the map of process -> counts. We train an autoencoder on the vectorized data. This network is able to identify unusual inputs that may be useful for discovering attacks." - ] - } - ], - "metadata": { - "kernelspec": { - "display_name": "Python 3", - "language": "python", - "name": "python3" - }, - "language_info": { - "codemirror_mode": { - "name": "ipython", - "version": 3 - }, - "file_extension": ".py", - "mimetype": "text/x-python", - "name": "python", - "nbconvert_exporter": "python", - "pygments_lexer": "ipython3", - "version": "3.8.5" - } - }, - "nbformat": 4, - "nbformat_minor": 5 -} diff --git a/notebooks/detect_dump_lsass.exe_memory_using_comsvcs.ipynb b/notebooks/detect_dump_lsass.exe_memory_using_comsvcs.ipynb deleted file mode 100644 index 89cf7decf3..0000000000 --- a/notebooks/detect_dump_lsass.exe_memory_using_comsvcs.ipynb +++ /dev/null @@ -1,179 +0,0 @@ -{ - "cells": [ - { - "cell_type": "markdown", - "metadata": { - "execution": { - "iopub.execute_input": "2020-09-24T04:06:52.928068Z", - "iopub.status.busy": "2020-09-24T04:06:52.927779Z", - "iopub.status.idle": "2020-09-24T04:06:52.934766Z", - "shell.execute_reply": "2020-09-24T04:06:52.934058Z", - "shell.execute_reply.started": "2020-09-24T04:06:52.928046Z" - } - }, - "source": [ - "# Detect Dump LSASS.exe Memory using comsvcs\n", - "\n", - "#### This search detects the memory of lsass.exe being dumped for offline credential theft attack.\n", - "\n", - "References: https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf\n", - "\n", - "Author: Jose Hernandez, Splunk\n", - "\n", - "Known false positives: None identified.\n", - "\n", - "Tags: Credential Dumping, T1003.003, Actions on Objectives, CIS 8, CIS 16\n", - "\n", - "Source: https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" - ] - }, - { - "cell_type": "code", - "execution_count": 1, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-19T19:49:47.098495Z", - "iopub.status.busy": "2020-10-19T19:49:47.098215Z", - "iopub.status.idle": "2020-10-19T19:49:50.310310Z", - "shell.execute_reply": "2020-10-19T19:49:50.309793Z", - "shell.execute_reply.started": "2020-10-19T19:49:47.098471Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "bb8622490e2143d2b9414eadac5441af", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
processmachineprocess_nameinput_eventtenanttimestamp
0\"c:\\windows\\system32\\rundll32.exe\" c:\\windows\\...eyJlbnRpdHlUeXBlIjoiREVWSUNFIiwicHJpbWFyeUFydG...rundll32.exe{'_tenant': 'test', '_time': '1600731080000', ...test2020-09-21 23:31:20
\n", - "
" - ], - "text/plain": [ - " process ... timestamp\n", - "0 \"c:\\windows\\system32\\rundll32.exe\" c:\\windows\\... ... 2020-09-21 23:31:20\n", - "\n", - "[1 rows x 6 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 1, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "| from read_text(\"s3://smle-experiments/datasets/attack-range/T1003.001/windows-security-events_ssa.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval tenant=ucast(map_get(input_event, \"_tenant\"), \"string\", null),\n", - "machine=ucast(map_get(input_event, \"dest_ip_id\"), \"string\", null),\n", - "process_name=lower(ucast(map_get(input_event, \"process_name\"), \"string\", null)),\n", - "timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - "process=lower(ucast(map_get(input_event, \"process\"), \"string\", null))\n", - "| where process_name LIKE \"%rundll32.exe%\"\n", - "AND match_regex(process, /(?i)comsvcs.dll[,\\s]+MiniDump/)=true;" - ] - }, - { - "cell_type": "markdown", - "metadata": { - "execution": { - "iopub.execute_input": "2020-09-24T04:07:41.132723Z", - "iopub.status.busy": "2020-09-24T04:07:41.132299Z", - "iopub.status.idle": "2020-09-24T04:07:41.142005Z", - "shell.execute_reply": "2020-09-24T04:07:41.141000Z", - "shell.execute_reply.started": "2020-09-24T04:07:41.132683Z" - } - }, - "source": [ - "# Dataset \n", - "This data set way generated via launching [atomic red team](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/) technique ID: T1003.01 and results were captured by the [Splunk Attack Range](https://github.com/splunk/attack_range).\n", - "This detection specifically address [atomic](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-3---dump-lsassexe-memory-using-comsvcsdll)\n", - "Source: https://github.com/splunk/attack_data/blob/master/datasets/T1003.001/dataset.yml" - ] - } - ], - "metadata": { - "kernelspec": { - "display_name": "SPL2", - "language": "SPL", - "name": "spl2" - }, - "language_info": { - "mimetype": "text/spl", - "name": "SPL" - } - }, - "nbformat": 4, - "nbformat_minor": 4 -} diff --git a/notebooks/detect_kerberoasting__ssa.ipynb b/notebooks/detect_kerberoasting__ssa.ipynb deleted file mode 100644 index 1c905de653..0000000000 --- a/notebooks/detect_kerberoasting__ssa.ipynb +++ /dev/null @@ -1,143 +0,0 @@ -{ - "cells": [ - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "# Detect Kerberoasting\n", - "### This is the SPL2 to test content: detections/endpoint/detect_kerberoasting__ssa.yml" - ] - }, - { - "cell_type": "code", - "execution_count": 1, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-28T22:35:40.972663Z", - "iopub.status.busy": "2020-10-28T22:35:40.972286Z", - "iopub.status.idle": "2020-10-28T22:35:42.632374Z", - "shell.execute_reply": "2020-10-28T22:35:42.631440Z", - "shell.execute_reply.started": "2020-10-28T22:35:40.972629Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "2ea98fa914f748d487beaf1b4b188a4d", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
end_timestart_timebodyentities
011191119TBDTBD
\n", - "
" - ], - "text/plain": [ - " end_time start_time body entities\n", - "0 1119 1119 TBD TBD" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 1, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "| from read_text(\"s3://smle-experiments/datasets/ssa/T1558.003.json\")\n", - "| eval input_event=from_json_object(value)\n", - "| eval _time=map_get(input_event, \"_time\"), EventCode=map_get(input_event, \"event_code\"), TicketOptions=map_get(input_event, \"ticket_options\"), TicketEncryptionType=map_get(input_event, \"ticket_encryption_type\"), ServiceName=map_get(input_event, \"service_name\"), ServiceID=map_get(input_event, \"service_id\")\n", - "| where EventCode=\"4769\" AND TicketOptions=\"0x40810000\" AND TicketEncryptionType=\"0x17\"\n", - "| first_time_event cache_partitions=1 input_columns=\"EventCode,TicketOptions,TicketEncryptionType,ServiceName,ServiceID\"\n", - "| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID\n", - "| eval start_time=_time, end_time=_time, body=\"TBD\", entities=\"TBD\"\n", - "| select start_time, end_time, entities, body \n", - ";" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "metadata": {}, - "outputs": [], - "source": [] - } - ], - "metadata": { - "kernelspec": { - "display_name": "SPL2", - "language": "SPL", - "name": "spl2" - }, - "language_info": { - "mimetype": "text/spl", - "name": "SPL" - } - }, - "nbformat": 4, - "nbformat_minor": 4 -} diff --git a/notebooks/detect_pass_hash__ssa.ipynb b/notebooks/detect_pass_hash__ssa.ipynb deleted file mode 100644 index e62bda7465..0000000000 --- a/notebooks/detect_pass_hash__ssa.ipynb +++ /dev/null @@ -1,159 +0,0 @@ -{ - "cells": [ - { - "cell_type": "markdown", - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-14T00:24:08.027638Z", - "iopub.status.busy": "2020-10-14T00:24:08.027292Z", - "iopub.status.idle": "2020-10-14T00:24:08.030791Z", - "shell.execute_reply": "2020-10-14T00:24:08.030084Z", - "shell.execute_reply.started": "2020-10-14T00:24:08.027607Z" - } - }, - "source": [ - "# Detect Pass the Hash\n", - "### This is the SPL2 to test content: detections/endpoint/detect_pass_hash__ssa.yml" - ] - }, - { - "cell_type": "code", - "execution_count": 1, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-28T22:35:49.966691Z", - "iopub.status.busy": "2020-10-28T22:35:49.966422Z", - "iopub.status.idle": "2020-10-28T22:35:51.544851Z", - "shell.execute_reply": "2020-10-28T22:35:51.543629Z", - "shell.execute_reply.started": "2020-10-28T22:35:49.966620Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "bc96630916c54e68bc29ac51a679c08e", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
end_timestart_timebodyentities
066TBDTBD
188TBDTBD
\n", - "
" - ], - "text/plain": [ - " end_time start_time body entities\n", - "0 6 6 TBD TBD\n", - "1 8 8 TBD TBD" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 1, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "| from read_text(\"s3://smle-experiments/datasets/ssa/T1550.002.json\")\n", - "| eval input_event=from_json_object(value)\n", - "| eval _time=map_get(input_event, \"_time\"), EventCode=map_get(input_event, \"event_code\"), LogonType=map_get(input_event, \"logon_type\"), LogonProcess=map_get(input_event, \"logon_process\"), ComputerName=map_get(input_event, \"dest_ip_primary_artifact\"), AccountName=map_get(input_event, \"dest_user_primary_artifact\")\n", - "| where (LogonType=\"3\" AND LogonProcess=\"NtLmSsp\" AND AccountName IS NOT NULL) OR (LogonType=\"9\" AND LogonProcess=\"seclogo\")\n", - "| first_time_event cache_partitions=1 input_columns=\"EventCode,LogonProcess,ComputerName\"\n", - "| where first_time_EventCode_LogonProcess_ComputerName\n", - "| eval start_time=_time, end_time=_time, body=\"TBD\", entities=\"TBD\"\n", - "| select start_time, end_time, entities, body \n", - ";" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "metadata": {}, - "outputs": [], - "source": [] - } - ], - "metadata": { - "kernelspec": { - "display_name": "SPL2", - "language": "SPL", - "name": "spl2" - }, - "language_info": { - "mimetype": "text/spl", - "name": "SPL" - } - }, - "nbformat": 4, - "nbformat_minor": 4 -} diff --git a/notebooks/phishing_detection_unit_test.ipynb b/notebooks/phishing_detection_unit_test.ipynb deleted file mode 100644 index 805579a80b..0000000000 --- a/notebooks/phishing_detection_unit_test.ipynb +++ /dev/null @@ -1,222 +0,0 @@ -{ - "cells": [ - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "## Unit Test for Phishing Detection Model" - ] - }, - { - "cell_type": "code", - "execution_count": 1, - "metadata": { - "execution": { - "iopub.status.idle": "2020-10-22T00:20:24.890053Z", - "shell.execute_reply": "2020-10-22T00:20:24.889186Z", - "shell.execute_reply.started": "2020-10-22T00:20:24.160138Z" - } - }, - "outputs": [], - "source": [ - "import numpy as np\n", - "import pandas as pd\n", - "\n", - "%load_ext spl2_kernel" - ] - }, - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "## Extract first 10 records from the test dataset as unit test data" - ] - }, - { - "cell_type": "code", - "execution_count": 2, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-22T00:20:24.891960Z", - "iopub.status.busy": "2020-10-22T00:20:24.891603Z", - "iopub.status.idle": "2020-10-22T00:20:25.723640Z", - "shell.execute_reply": "2020-10-22T00:20:25.722836Z", - "shell.execute_reply.started": "2020-10-22T00:20:24.891925Z" - } - }, - "outputs": [ - { - "name": "stderr", - "output_type": "stream", - "text": [ - "/opt/conda/lib/python3.7/site-packages/dateutil/parser/_parser.py:1218: UnknownTimezoneWarning: tzname BST identified but not understood. Pass `tzinfos` argument in order to correctly return a timezone-aware datetime. In a future version, this will raise an exception.\n", - " category=UnknownTimezoneWarning)\n", - "/opt/conda/lib/python3.7/site-packages/dateutil/parser/_parser.py:1218: UnknownTimezoneWarning: tzname EDT identified but not understood. Pass `tzinfos` argument in order to correctly return a timezone-aware datetime. In a future version, this will raise an exception.\n", - " category=UnknownTimezoneWarning)\n", - "/opt/conda/lib/python3.7/site-packages/dateutil/parser/_parser.py:1218: UnknownTimezoneWarning: tzname EST identified but not understood. Pass `tzinfos` argument in order to correctly return a timezone-aware datetime. In a future version, this will raise an exception.\n", - " category=UnknownTimezoneWarning)\n" - ] - } - ], - "source": [ - "df = pd.read_json('s3://smle-experiments/datasets/phishing_email/splunk_test.json', lines=True)[0:10]\n", - "t = [i for i in range(10)]\n", - "df['_time'] = t\n", - "df.to_json('./detect_phishing_content.json', orient='records', lines=True)" - ] - }, - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "## SPL2 string to perform model inference for phishing detection" - ] - }, - { - "cell_type": "code", - "execution_count": 3, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-22T00:20:25.725171Z", - "iopub.status.busy": "2020-10-22T00:20:25.724951Z", - "iopub.status.idle": "2020-10-22T00:20:35.007199Z", - "shell.execute_reply": "2020-10-22T00:20:35.005911Z", - "shell.execute_reply.started": "2020-10-22T00:20:25.725149Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "5001252ce5834d52bb5668b0878c04c0", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
end_timestart_timebodyentitiesprobability
044TBDTBD0.999498
\n", - "
" - ], - "text/plain": [ - " end_time start_time body entities probability\n", - "0 4 4 TBD TBD 0.999498" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 3, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2\n", - "| from read_json(\"s3://smle-experiments/datasets/phishing_email/detect_phishing_content.json\")\n", - "| eval eventLine=concat(From, \" \", Subject, \" \", Content, \" \", \" \")\n", - "| where eventLine IS NOT NULL\n", - "| eval mapC = {\" \":32,\"!\":33,\"\\\"\":34,\"#\":35,\"$$\":36,\"%\":37,\"&\":38,\"'\":39,\"(\":40,\")\":41,\"*\":42,\"+\":43,\",\":44,\"-\":45,\".\":46,\"/\":47,\"0\":48,\"1\":49,\"2\":50,\"3\":51,\"4\":52,\"5\":53,\"6\":54,\"7\":55,\"8\":56,\"9\":57,\":\":58,\";\":59,\"<\":60,\"=\":61,\">\":62,\"?\":63,\"@\":64,\"A\":65,\"B\":66,\"C\":67,\"D\":68,\"E\":69,\"F\":70,\"G\":71,\"H\":72,\"I\":73,\"J\":74,\"K\":75,\"L\":76,\"M\":77,\"N\":78,\"O\":79,\"P\":80,\"Q\":81,\"R\":82,\"S\":83,\"T\":84,\"U\":85,\"V\":86,\"W\":87,\"X\":88,\"Y\":89,\"Z\":90,\"[\":91,\"\\\\\":92,\"]\":93,\"^\":94,\"_\":95,\"`\":96,\"a\":97,\"b\":98,\"c\":99,\"d\":100,\"e\":101,\"f\":102,\"g\":103,\"h\":104,\"i\":105,\"j\":106,\"k\":107,\"l\":108,\"m\":109,\"n\":110,\"o\":111,\"p\":112,\"q\":113,\"r\":114,\"s\":115,\"t\":116,\"u\":117,\"v\":118,\"w\":119,\"x\":120,\"y\":121,\"z\":122,\"{\":123,\"|\":124,\"}\":125,\"~\":126}\n", - "| eval ml_in = for_each(\n", - " iterator(mvrange(1,129), \"i\"),\n", - " cast(map_get(mapC, substr(eventLine, i, 1)), \"float\") )\n", - "| apply_model connection_id=\"\" path=\"s3://smle-experiments/models/xlin/phishing_email\" name=\"phishing_email_v8\" \n", - "| eval probability = mvindex(ml_out, 0) \n", - "| where probability > 0.5\n", - "| eval start_time = _time, end_time = _time, entities = \"TBD\", body = \"TBD\"\n", - "| select probability, body, entities, start_time, end_time\n", - ";" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "metadata": {}, - "outputs": [], - "source": [] - } - ], - "metadata": { - "kernelspec": { - "display_name": "Python 3", - "language": "python", - "name": "python3" - }, - "language_info": { - "codemirror_mode": { - "name": "ipython", - "version": 3 - }, - "file_extension": ".py", - "mimetype": "text/x-python", - "name": "python", - "nbconvert_exporter": "python", - "pygments_lexer": "ipython3", - "version": "3.7.8" - } - }, - "nbformat": 4, - "nbformat_minor": 4 -} diff --git a/notebooks/rare_parent_process_relationship_lolbas.ipynb b/notebooks/rare_parent_process_relationship_lolbas.ipynb deleted file mode 100644 index 57d099f502..0000000000 --- a/notebooks/rare_parent_process_relationship_lolbas.ipynb +++ /dev/null @@ -1,330 +0,0 @@ -{ - "cells": [ - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "# Rare Parent/Child Process Relationship\n", - "\n", - "An attacker may use LOLBAS tools spawned from vulnerable applications not typically used by system administrators. This search leverages the Splunk Streaming ML DSP plugin to find rare parent/child relationships. The list of application has been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries\n", - "\n", - "https://github.com/splunk/security-content/blob/unit_test_prohibited_apps_spawning_cmdprompt/detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml" - ] - }, - { - "cell_type": "code", - "execution_count": 22, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-15T21:50:56.862479Z", - "iopub.status.busy": "2020-10-15T21:50:56.862220Z", - "iopub.status.idle": "2020-10-15T21:51:06.101230Z", - "shell.execute_reply": "2020-10-15T21:51:06.100748Z", - "shell.execute_reply.started": "2020-10-15T21:50:56.862456Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "38a2bbfe856f4bf797b49f98bb92e6be", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
inputstart_timedest_device_identitiesprocess_namequantileend_timelabelparent_processbodytimestampdest_user_id
07.6666672020-09-24 17:00:135gUXDbXvVfgC/FEpZOFUaA==[5gUXDbXvVfgC/FEpZOFUaA==]powershell.exe0.0000002020-09-24 17:00:13Truec:\\windows\\system32\\cmd.exeTBD2020-09-24 17:00:13NaN
11.1647252020-09-24 17:15:125gUXDbXvVfgC/FEpZOFUaA==[5gUXDbXvVfgC/FEpZOFUaA==]cmd.exe0.0829192020-09-24 17:15:12Truec:\\program files\\splunkforwarderforsplunkinc\\b...TBD2020-09-24 17:15:12NaN
21.1642282020-09-24 17:17:125gUXDbXvVfgC/FEpZOFUaA==[5gUXDbXvVfgC/FEpZOFUaA==]cmd.exe0.0810372020-09-24 17:17:12Truec:\\program files\\splunkforwarderforsplunkinc\\b...TBD2020-09-24 17:17:12NaN
31.1617422020-09-24 17:18:04IaNYgFTNQvyVmJNuPr58dQ==[IaNYgFTNQvyVmJNuPr58dQ==]cmd.exe0.0837212020-09-24 17:18:04Truec:\\program files\\splunkforwarderforsplunkinc\\b...TBD2020-09-24 17:18:04NaN
41.1582952020-09-24 17:18:125gUXDbXvVfgC/FEpZOFUaA==[5gUXDbXvVfgC/FEpZOFUaA==]cmd.exe0.0576632020-09-24 17:18:12Truec:\\program files\\splunkforwarderforsplunkinc\\b...TBD2020-09-24 17:18:12NaN
.......................................
17996.9184862020-09-25 19:46:23ZTQ/ltGlScpA4WGbfRJ0Xg==[ZTQ/ltGlScpA4WGbfRJ0Xg==]sc.exe0.0008432020-09-25 19:46:23Truec:\\windows\\system32\\svchost.exeTBD2020-09-25 19:46:23NaN
18008.5672702020-09-25 16:49:46lQ+9FBHxYQK/q8qXcrTE9A==[lQ+9FBHxYQK/q8qXcrTE9A==]sc.exe0.0008412020-09-25 16:49:46Truec:\\windows\\system32\\svchost.exeTBD2020-09-25 16:49:46NaN
18019.9914792020-09-25 16:50:30IaNYgFTNQvyVmJNuPr58dQ==[IaNYgFTNQvyVmJNuPr58dQ==]sc.exe0.0033612020-09-25 16:50:30Truec:\\windows\\system32\\svchost.exeTBD2020-09-25 16:50:30NaN
18025.4039342020-09-26 05:00:40OWUYaWKrJeuOY71+TXoqiw==[OWUYaWKrJeuOY71+TXoqiw==]cmd.exe0.0000002020-09-26 05:00:40Truec:\\program files\\splunkuniversalforwarder\\bin\\...TBD2020-09-26 05:00:40NaN
18030.0356482020-09-26 05:06:18OWUYaWKrJeuOY71+TXoqiw==[OWUYaWKrJeuOY71+TXoqiw==, rXYtTmzIXq56PqQ+iNO...cmd.exe0.0000002020-09-26 05:06:18Truec:\\windows\\system32\\cmd.exeTBD2020-09-26 05:06:18rXYtTmzIXq56PqQ+iNO/xw==
\n", - "

1804 rows × 12 columns

\n", - "
" - ], - "text/plain": [ - " input ... dest_user_id\n", - "0 7.666667 ... NaN\n", - "1 1.164725 ... NaN\n", - "2 1.164228 ... NaN\n", - "3 1.161742 ... NaN\n", - "4 1.158295 ... NaN\n", - "... ... ... ...\n", - "1799 6.918486 ... NaN\n", - "1800 8.567270 ... NaN\n", - "1801 9.991479 ... NaN\n", - "1802 5.403934 ... NaN\n", - "1803 0.035648 ... rXYtTmzIXq56PqQ+iNO/xw==\n", - "\n", - "[1804 rows x 12 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 22, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "| from read_text(\"s3://smle-experiments/datasets/ssa/T1059.all.labeled.lolbas-test.json\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=ucast(map_get(input_event, \"_time\"), \"long\", null)\n", - "| eval parent_process=lower(ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)), \n", - "process_name=lower(ucast(map_get(input_event, \"process_name\"), \"string\", null)), \n", - "dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - "dest_device_id=ucast(map_get(input_event, \"dest_device_id\"), \"string\", null)\n", - "| where parent_process!=null \n", - "| select parent_process, process_name, timestamp, dest_device_id, dest_user_id \n", - "| conditional_anomaly conditional=\"parent_process\" target=\"process_name\" \n", - "| rename output as input \n", - "| adaptive_threshold algorithm=\"quantile\" entity=\"parent_process\" value=\"input\" window=604800000L \n", - "| where label AND quantile<0.1 AND (process_name=\"powershell.exe\" OR process_name=\"regsvcs.exe\" OR process_name=\"ftp.exe\" OR process_name=\"dfsvc.exe\" OR process_name=\"rasautou.exe\" OR process_name=\"schtasks.exe\" OR process_name=\"xwizard.exe\" OR process_name=\"findstr.exe\" OR process_name=\"esentutl.exe\" OR process_name=\"cscript.exe\" OR process_name=\"reg.exe\" OR process_name=\"csc.exe\" OR process_name=\"atbroker.exe\" OR process_name=\"print.exe\" OR process_name=\"pcwrun.exe\" OR process_name=\"vbc.exe\" OR process_name=\"rpcping.exe\" OR process_name=\"wsreset.exe\" OR process_name=\"ilasm.exe\" OR process_name=\"certutil.exe\" OR process_name=\"replace.exe\" OR process_name=\"mshta.exe\" OR process_name=\"bitsadmin.exe\" OR process_name=\"wscript.exe\" OR process_name=\"ieexec.exe\" OR process_name=\"cmd.exe\" OR process_name=\"microsoft.workflow.compiler.exe\" OR process_name=\"runscripthelper.exe\" OR process_name=\"makecab.exe\" OR process_name=\"forfiles.exe\" OR process_name=\"desktopimgdownldr.exe\" OR process_name=\"control.exe\" OR process_name=\"msbuild.exe\" OR process_name=\"register-cimprovider.exe\" OR process_name=\"tttracer.exe\" OR process_name=\"ie4uinit.exe\" OR process_name=\"sc.exe\" OR process_name=\"bash.exe\" OR process_name=\"hh.exe\" OR process_name=\"cmstp.exe\" OR process_name=\"mmc.exe\" OR process_name=\"jsc.exe\" OR process_name=\"scriptrunner.exe\" OR process_name=\"odbcconf.exe\" OR process_name=\"extexport.exe\" OR process_name=\"msdt.exe\" OR process_name=\"diskshadow.exe\" OR process_name=\"extrac32.exe\" OR process_name=\"eventvwr.exe\" OR process_name=\"mavinject.exe\" OR process_name=\"regasm.exe\" OR process_name=\"gpscript.exe\" OR process_name=\"rundll32.exe\" OR process_name=\"regsvr32.exe\" OR process_name=\"regedit.exe\" OR process_name=\"msiexec.exe\" OR process_name=\"gfxdownloadwrapper.exe\" OR process_name=\"presentationhost.exe\" OR process_name=\"regini.exe\" OR process_name=\"wmic.exe\" OR process_name=\"runonce.exe\" OR process_name=\"syncappvpublishingserver.exe\" OR process_name=\"verclsid.exe\" OR process_name=\"psr.exe\" OR process_name=\"infdefaultinstall.exe\" OR process_name=\"explorer.exe\" OR process_name=\"expand.exe\" OR process_name=\"installutil.exe\" OR process_name=\"netsh.exe\" OR process_name=\"wab.exe\" OR process_name=\"dnscmd.exe\" OR process_name=\"at.exe\" OR process_name=\"pcalua.exe\" OR process_name=\"cmdkey.exe\" OR process_name=\"msconfig.exe\")\n", - "| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = \"TBD\";" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "metadata": {}, - "outputs": [], - "source": [] - } - ], - "metadata": { - "kernelspec": { - "display_name": "SPL2", - "language": "SPL", - "name": "spl2" - }, - "language_info": { - "mimetype": "text/spl", - "name": "SPL" - } - }, - "nbformat": 4, - "nbformat_minor": 4 -} diff --git a/notebooks/ssa___CredentialExtraction.ipynb b/notebooks/ssa___CredentialExtraction.ipynb deleted file mode 100644 index ca3f6cef56..0000000000 --- a/notebooks/ssa___CredentialExtraction.ipynb +++ /dev/null @@ -1,1828 +0,0 @@ -{ - "cells": [ - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "# Credential Extraction" - ] - }, - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "### FGdump" - ] - }, - { - "cell_type": "code", - "execution_count": 1, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-21T18:06:20.305699Z", - "iopub.status.busy": "2020-10-21T18:06:20.305420Z", - "iopub.status.idle": "2020-10-21T18:06:35.431304Z", - "shell.execute_reply": "2020-10-21T18:06:35.430703Z", - "shell.execute_reply.started": "2020-10-21T18:06:20.305672Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "ce9b4b5a9ad04012bca3a6f99f1650b5", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
start_timecmd_lineentitiesprocess_nameparent_process_nameend_timeprocess_pathinput_eventtimestamp
02020-09-14 20:57:28-v[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...cachedump64.exeC:\\Users\\Administrator\\Downloads\\fgdump-2.1.0-...2020-09-14 20:57:28c:\\users\\admini~1\\appdata\\local\\temp{'_tenant': 'test', '_time': '1600117048000', ...2020-09-14 20:57:28
\n", - "
" - ], - "text/plain": [ - " start_time ... timestamp\n", - "0 2020-09-14 20:57:28 ... 2020-09-14 20:57:28\n", - "\n", - "[1 rows x 9 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 1, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 --parallelism=7\n", - "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logFgdump.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - " cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null),\n", - " process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null),\n", - " process_path=ucast(map_get(input_event, \"process_path\"), \"string\", null),\n", - " parent_process_name=ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)\n", - "| where cmd_line != null AND\n", - " match_regex(parent_process_name, /(?i)fgdump.exe/)=true\n", - "| eval start_time = timestamp,\n", - " end_time = timestamp,\n", - " entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - " ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));" - ] - }, - { - "cell_type": "code", - "execution_count": 12, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-19T07:31:33.752874Z", - "iopub.status.busy": "2020-10-19T07:31:33.752605Z", - "iopub.status.idle": "2020-10-19T07:31:36.961722Z", - "shell.execute_reply": "2020-10-19T07:31:36.960969Z", - "shell.execute_reply.started": "2020-10-19T07:31:33.752852Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "8ed2f12e58284468be940ca472904ca6", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
start_timecmd_lineentitiesprocess_nameparent_process_nameend_timeprocess_pathinput_eventtimestamp
02020-09-14 20:57:28\"\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\cachedu...[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...cachedump64.exeC:\\Windows\\System32\\services.exe2020-09-14 20:57:28c:\\users\\admini~1\\appdata\\local\\temp{'_tenant': 'test', '_time': '1600117048000', ...2020-09-14 20:57:28
\n", - "
" - ], - "text/plain": [ - " start_time ... timestamp\n", - "0 2020-09-14 20:57:28 ... 2020-09-14 20:57:28\n", - "\n", - "[1 rows x 9 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 12, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 --parallelism=7\n", - "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logFgdump.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - " cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null),\n", - " process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null),\n", - " process_path=ucast(map_get(input_event, \"process_path\"), \"string\", null),\n", - " parent_process_name=ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)\n", - "| where cmd_line != null AND process_name != null AND parent_process_name != null AND\n", - " match_regex(parent_process_name, /(?i)System32\\\\services.exe/)=true AND\n", - " match_regex(process_name, /(?i)cachedump\\d{0,2}.exe/)=true AND\n", - " match_regex(process_path, /(?i)\\\\Temp/)=true AND\n", - " match_regex(cmd_line, /(?i)\\-s/)=true \n", - "| eval start_time = timestamp,\n", - " end_time = timestamp,\n", - " entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - " ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));" - ] - }, - { - "cell_type": "code", - "execution_count": 4, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-19T06:43:38.657607Z", - "iopub.status.busy": "2020-10-19T06:43:38.657338Z", - "iopub.status.idle": "2020-10-19T06:43:43.943417Z", - "shell.execute_reply": "2020-10-19T06:43:43.942731Z", - "shell.execute_reply.started": "2020-10-19T06:43:38.657582Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "f54e0d67a72f4885b5728174656682dc", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
start_timecmd_lineentitiesprocess_nameend_timeprocess_pathinput_eventtimestamp
02020-09-14 20:57:28-v[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...cachedump64.exe2020-09-14 20:57:28c:\\users\\admini~1\\appdata\\local\\temp{'_tenant': 'test', '_time': '1600117048000', ...2020-09-14 20:57:28
\n", - "
" - ], - "text/plain": [ - " start_time ... timestamp\n", - "0 2020-09-14 20:57:28 ... 2020-09-14 20:57:28\n", - "\n", - "[1 rows x 8 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 4, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 --parallelism=7\n", - "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logFgdump.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - " cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null),\n", - " process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null),\n", - " process_path=ucast(map_get(input_event, \"process_path\"), \"string\", null)\n", - "| where cmd_line != null AND process_name != null AND process_path != null AND\n", - " match_regex(process_name, /(?i)cachedump\\d{0,2}.exe/)=true AND\n", - " match_regex(process_path, /(?i)\\\\Temp/)=true AND\n", - " match_regex(cmd_line, /(?i)\\-v/)=true \n", - "| eval start_time = timestamp,\n", - " end_time = timestamp,\n", - " entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - " ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));" - ] - }, - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "### LaZagne" - ] - }, - { - "cell_type": "code", - "execution_count": 209, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-16T11:11:37.602675Z", - "iopub.status.busy": "2020-10-16T11:11:37.602388Z", - "iopub.status.idle": "2020-10-16T11:11:38.897829Z", - "shell.execute_reply": "2020-10-16T11:11:38.897200Z", - "shell.execute_reply.started": "2020-10-16T11:11:37.602651Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "ea6d405d5dbb45fbbdcccd118a5a74fa", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
end_timestart_timeentitiesprocess_nameinput_eventtimestamp
02020-09-12 01:25:412020-09-12 01:25:41[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...lazagne.exe{'_tenant': 'test', '_time': '1599873941000', ...2020-09-12 01:25:41
12020-09-12 01:25:412020-09-12 01:25:41[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...lazagne.exe{'_tenant': 'test', '_time': '1599873941000', ...2020-09-12 01:25:41
\n", - "
" - ], - "text/plain": [ - " end_time ... timestamp\n", - "0 2020-09-12 01:25:41 ... 2020-09-12 01:25:41\n", - "1 2020-09-12 01:25:41 ... 2020-09-12 01:25:41\n", - "\n", - "[2 rows x 6 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 209, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 --parallelism=7\n", - "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logLazagneCredDump.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - " process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null)\n", - "| where process_name != null AND\n", - " match_regex(process_name, /(?i)lazagne.exe/)=true \n", - "| eval start_time = timestamp,\n", - " end_time = timestamp,\n", - " entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - " ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));" - ] - }, - { - "cell_type": "code", - "execution_count": 5, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-19T06:44:15.842408Z", - "iopub.status.busy": "2020-10-19T06:44:15.842154Z", - "iopub.status.idle": "2020-10-19T06:44:17.835759Z", - "shell.execute_reply": "2020-10-19T06:44:17.835188Z", - "shell.execute_reply.started": "2020-10-19T06:44:15.842387Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "d20cc7f7621b4e449419b4216187807c", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
end_timestart_timecmd_lineentitiesinput_eventtimestamp
02020-09-12 01:25:412020-09-12 01:25:41lazagne all -oA -output lazDump.txt[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...{'_tenant': 'test', '_time': '1599873941000', ...2020-09-12 01:25:41
12020-09-12 01:25:412020-09-12 01:25:41lazagne all -oA -output lazDump.txt[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...{'_tenant': 'test', '_time': '1599873941000', ...2020-09-12 01:25:41
\n", - "
" - ], - "text/plain": [ - " end_time ... timestamp\n", - "0 2020-09-12 01:25:41 ... 2020-09-12 01:25:41\n", - "1 2020-09-12 01:25:41 ... 2020-09-12 01:25:41\n", - "\n", - "[2 rows x 6 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 5, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 --parallelism=7\n", - "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logLazagneCredDump.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - " cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null)\n", - "| where cmd_line != null AND\n", - " match_regex(cmd_line, /(?i)all\\s+\\-oA\\s+\\-output/)=true \n", - "| eval start_time = timestamp,\n", - " end_time = timestamp,\n", - " entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - " ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));" - ] - }, - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "### PowerSploit/DSInternals" - ] - }, - { - "cell_type": "code", - "execution_count": 6, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-19T06:44:32.330847Z", - "iopub.status.busy": "2020-10-19T06:44:32.330579Z", - "iopub.status.idle": "2020-10-19T06:44:34.317758Z", - "shell.execute_reply": "2020-10-19T06:44:34.317168Z", - "shell.execute_reply.started": "2020-10-19T06:44:32.330825Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "55e657aa20074cbaa58dfbcc45ca5ec0", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
end_timestart_timecmd_lineentitiesinput_eventtimestamp
02020-09-17 18:59:052020-09-17 18:59:05powershell -command \"\"Get-ADDBAccount -All -D...[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...{'_tenant': 'test', '_time': '1600369145000', ...2020-09-17 18:59:05
\n", - "
" - ], - "text/plain": [ - " end_time ... timestamp\n", - "0 2020-09-17 18:59:05 ... 2020-09-17 18:59:05\n", - "\n", - "[1 rows x 6 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 6, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 --parallelism=7\n", - "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logPowerShellModule.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - " cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null)\n", - "| where cmd_line != null AND\n", - " match_regex(cmd_line, /(?i)Get-ADDBAccount/)=true AND\n", - " match_regex(cmd_line, /(?i)\\-dbpath[\\s;:\\.\\|]+/)=true\n", - "| eval start_time = timestamp,\n", - " end_time = timestamp,\n", - " entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - " ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));" - ] - }, - { - "cell_type": "markdown", - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-16T18:40:38.543645Z", - "iopub.status.busy": "2020-10-16T18:40:38.543331Z", - "iopub.status.idle": "2020-10-16T18:40:38.546643Z", - "shell.execute_reply": "2020-10-16T18:40:38.545902Z", - "shell.execute_reply.started": "2020-10-16T18:40:38.543617Z" - } - }, - "source": [ - "### Windows-native debuggers: NTKD, LiveKD" - ] - }, - { - "cell_type": "code", - "execution_count": 7, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-19T06:44:40.113042Z", - "iopub.status.busy": "2020-10-19T06:44:40.112773Z", - "iopub.status.idle": "2020-10-19T06:44:42.191978Z", - "shell.execute_reply": "2020-10-19T06:44:42.191344Z", - "shell.execute_reply.started": "2020-10-19T06:44:40.113019Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "71f723f491ba4ba29302108a6b3119b8", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
start_timecmd_lineentitiesprocess_nameend_timeinput_eventtimestamp
02020-09-14 17:31:20\"C:\\Program Files (x86)\\Windows Kits\\10\\Debugg...[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...ntkd.exe2020-09-14 17:31:20{'_tenant': 'test', '_time': '1600104680000', ...2020-09-14 17:31:20
\n", - "
" - ], - "text/plain": [ - " start_time ... timestamp\n", - "0 2020-09-14 17:31:20 ... 2020-09-14 17:31:20\n", - "\n", - "[1 rows x 7 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 7, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 --parallelism=7\n", - "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logNtkdDump.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - " cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null),\n", - " process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null)\n", - "| where cmd_line != null AND process_name != null AND \n", - " ( \n", - " match_regex(process_name, /^(?i)ntkd\\.exe/)=true OR\n", - " match_regex(process_name, /^(?i)kd\\.exe/)=true \n", - " ) AND \n", - " match_regex(cmd_line, /(?i)\\-z\\s+/)=true\n", - "| eval start_time = timestamp,\n", - " end_time = timestamp,\n", - " entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - " ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));" - ] - }, - { - "cell_type": "raw", - "metadata": {}, - "source": [ - "------------------------------------------------\n", - "SAME DETECTION ON LiveKD's DATASET\n", - "------------------------------------------------" - ] - }, - { - "cell_type": "code", - "execution_count": 9, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-19T06:44:58.570342Z", - "iopub.status.busy": "2020-10-19T06:44:58.570056Z", - "iopub.status.idle": "2020-10-19T06:44:59.753230Z", - "shell.execute_reply": "2020-10-19T06:44:59.752699Z", - "shell.execute_reply.started": "2020-10-19T06:44:58.570317Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "ef72e8a6d72d41b3b8f3c231d0c74e24", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
start_timecmd_lineentitiesprocess_nameend_timeinput_eventtimestamp
02020-09-12 23:25:47kd.exe -z C:\\Windows\\livekd.dmp[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...kd.exe2020-09-12 23:25:47{'_tenant': 'test', '_time': '1599953147000', ...2020-09-12 23:25:47
\n", - "
" - ], - "text/plain": [ - " start_time ... timestamp\n", - "0 2020-09-12 23:25:47 ... 2020-09-12 23:25:47\n", - "\n", - "[1 rows x 7 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 9, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 --parallelism=7\n", - "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logLiveKDFullKernelDump.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - " cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null),\n", - " process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null)\n", - "| where cmd_line != null AND process_name != null AND \n", - " ( \n", - " match_regex(process_name, /^(?i)ntkd\\.exe/)=true OR\n", - " match_regex(process_name, /^(?i)kd\\.exe/)=true \n", - " ) AND \n", - " match_regex(cmd_line, /(?i)\\-z\\s+/)=true \n", - "| eval start_time = timestamp,\n", - " end_time = timestamp,\n", - " entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - " ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));" - ] - }, - { - "cell_type": "code", - "execution_count": 10, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-19T06:45:22.643424Z", - "iopub.status.busy": "2020-10-19T06:45:22.643152Z", - "iopub.status.idle": "2020-10-19T06:45:23.764872Z", - "shell.execute_reply": "2020-10-19T06:45:23.764356Z", - "shell.execute_reply.started": "2020-10-19T06:45:22.643401Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "83fc3507d11841139f30b4ff3d3fcf6c", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
start_timecmd_lineentitiesprocess_nameparent_process_nameend_timeinput_eventtimestamp
02020-09-12 23:25:44\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff...[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...conhost.exeC:\\Program Files (x86)\\Windows Kits\\10\\Debugge...2020-09-12 23:25:44{'_tenant': 'test', '_time': '1599953144000', ...2020-09-12 23:25:44
\n", - "
" - ], - "text/plain": [ - " start_time ... timestamp\n", - "0 2020-09-12 23:25:44 ... 2020-09-12 23:25:44\n", - "\n", - "[1 rows x 8 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 10, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 --parallelism=7\n", - "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logLiveKDFullKernelDump.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - " cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null),\n", - " process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null),\n", - " parent_process_name=ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)\n", - "| where cmd_line != null AND parent_process_name != null AND process_name != null AND \n", - " ( match_regex(parent_process_name, /(?i)ntkd\\.exe/)=true OR\n", - " match_regex(parent_process_name, /(?i)livekd\\.exe/)=true\n", - " ) AND\n", - " match_regex(process_name, /(?i)conhost\\.exe/)=true AND\n", - " match_regex(cmd_line, /(?i)0xffffffff/)=true AND\n", - " match_regex(cmd_line, /(?i)\\-ForceV1/)=true\n", - "| eval start_time = timestamp,\n", - " end_time = timestamp,\n", - " entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - " ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));" - ] - }, - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "### PowerSploit modules" - ] - }, - { - "cell_type": "code", - "execution_count": 4, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-21T18:29:40.267475Z", - "iopub.status.busy": "2020-10-21T18:29:40.267191Z", - "iopub.status.idle": "2020-10-21T18:29:45.564872Z", - "shell.execute_reply": "2020-10-21T18:29:45.564202Z", - "shell.execute_reply.started": "2020-10-21T18:29:40.267450Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "b33e383c863940a1968742c8886d5a37", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
end_timestart_timecmd_lineentitiesinput_eventtimestamp
02020-09-17 18:59:052020-09-17 18:59:05powershell -command \"\"Import-Module PowerSplo...[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...{'_tenant': 'test', '_time': '1600369145000', ...2020-09-17 18:59:05
12020-09-17 18:59:042020-09-17 18:59:04powershell -command \"\"Install-SSP; Install-Se...[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...{'_tenant': 'test', '_time': '1600369144000', ...2020-09-17 18:59:04
22020-09-17 18:59:032020-09-17 18:59:03powershell -command \"\"Get-IPAddress; Convert-...[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...{'_tenant': 'test', '_time': '1600369143000', ...2020-09-17 18:59:03
\n", - "
" - ], - "text/plain": [ - " end_time ... timestamp\n", - "0 2020-09-17 18:59:05 ... 2020-09-17 18:59:05\n", - "1 2020-09-17 18:59:04 ... 2020-09-17 18:59:04\n", - "2 2020-09-17 18:59:03 ... 2020-09-17 18:59:03\n", - "\n", - "[3 rows x 6 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 4, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 --parallelism=7\n", - "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logAllPowerSploitModulesWithOldNames.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - " cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null)\n", - "| where cmd_line != null AND\n", - " ( match_regex(cmd_line, /(?i)Get-ApplicationHost/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-CachedGPPPassword/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-GPPAutologon/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-GPPPassword/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-RegistryAutoLogon/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-SiteListPassword/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-SPNTicket/)=true OR\n", - " match_regex(cmd_line, /(?i)Request-SPNTicket/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-VaultCredential/)=true OR\n", - " match_regex(cmd_line, /(?i)Invoke-Kerberoast/)=true \n", - " )\n", - "| eval start_time = timestamp,\n", - " end_time = timestamp,\n", - " entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - " ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));" - ] - }, - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "### DSInternals" - ] - }, - { - "cell_type": "code", - "execution_count": 5, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-21T18:29:49.499740Z", - "iopub.status.busy": "2020-10-21T18:29:49.499462Z", - "iopub.status.idle": "2020-10-21T18:29:50.727426Z", - "shell.execute_reply": "2020-10-21T18:29:50.726855Z", - "shell.execute_reply.started": "2020-10-21T18:29:49.499716Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "d1d8d5a4f8184b47a32e8d3fa710d245", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
start_timecmd_lineentitiesprocess_nameparent_process_nameend_timeprocess_pathinput_eventtimestamp
02020-09-17 18:59:02powershell -command \"\"Install-Module DSIntern...[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...powershell.exeC:\\Windows\\System32\\cmd.exe2020-09-17 18:59:02c:\\windows\\system32\\windowspowershell\\v1.0{'_tenant': 'test', '_time': '1600369142000', ...2020-09-17 18:59:02
\n", - "
" - ], - "text/plain": [ - " start_time ... timestamp\n", - "0 2020-09-17 18:59:02 ... 2020-09-17 18:59:02\n", - "\n", - "[1 rows x 9 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 5, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 --parallelism=7\n", - "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logAllDSInternalsModules.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - " process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null),\n", - " process_path=ucast(map_get(input_event, \"process_path\"), \"string\", null),\n", - " cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null),\n", - " parent_process_name=ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)\n", - "| where cmd_line != null AND ( \n", - " match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-ADDBDomainController/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-ADDBKdsRootKey/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-ADDBSchemaAttribute/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-ADKeyCredential/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-ADReplAccount/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-ADReplBackupKey/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-ADSIAccount/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-AzureADUserEx/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-BootKey/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-LsaBackupKey/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-LsaPolicyInformation/)=true OR\n", - " match_regex(cmd_line, /(?i)Get-SamPasswordPolicy/)=true\n", - " ) \n", - "| eval start_time = timestamp,\n", - " end_time = timestamp,\n", - " entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - " ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));" - ] - }, - { - "cell_type": "raw", - "metadata": {}, - "source": [ - "------------------------------------------------\n", - "DSInternals credential converters and decryptors\n", - "------------------------------------------------" - ] - }, - { - "cell_type": "code", - "execution_count": 6, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-21T18:29:54.881202Z", - "iopub.status.busy": "2020-10-21T18:29:54.880838Z", - "iopub.status.idle": "2020-10-21T18:29:58.846049Z", - "shell.execute_reply": "2020-10-21T18:29:58.845520Z", - "shell.execute_reply.started": "2020-10-21T18:29:54.881168Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "f130a73e8b384980ac1998d2fea445f7", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=4.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
start_timecmd_lineentitiesprocess_nameparent_process_nameend_timeprocess_pathinput_eventtimestamp
02020-09-17 18:59:02powershell -command \"\"Install-Module DSIntern...[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...powershell.exeC:\\Windows\\System32\\cmd.exe2020-09-17 18:59:02c:\\windows\\system32\\windowspowershell\\v1.0{'_tenant': 'test', '_time': '1600369142000', ...2020-09-17 18:59:02
\n", - "
" - ], - "text/plain": [ - " start_time ... timestamp\n", - "0 2020-09-17 18:59:02 ... 2020-09-17 18:59:02\n", - "\n", - "[1 rows x 9 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 6, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 --parallelism=7\n", - "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logAllDSInternalsModules.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - " process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null),\n", - " process_path=ucast(map_get(input_event, \"process_path\"), \"string\", null),\n", - " cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null),\n", - " parent_process_name=ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)\n", - "| where cmd_line != null AND ( \n", - " match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true OR\n", - " match_regex(cmd_line, /(?i)ConvertFrom-GPPrefPassword/)=true OR\n", - " match_regex(cmd_line, /(?i)ConvertFrom-UnicodePassword/)=true OR\n", - " match_regex(cmd_line, /(?i)ConvertTo-GPPrefPassword/)=true OR\n", - " match_regex(cmd_line, /(?i)ConvertTo-KerberosKey/)=true OR\n", - " match_regex(cmd_line, /(?i)ConvertTo-LMHash/)=true OR\n", - " match_regex(cmd_line, /(?i)ConvertTo-NTHash/)=true OR\n", - " match_regex(cmd_line, /(?i)ConvertTo-OrgIdHash/)=true OR\n", - " match_regex(cmd_line, /(?i)ConvertTo-UnicodePassword/)=true\n", - " ) \n", - "| eval start_time = timestamp,\n", - " end_time = timestamp,\n", - " entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - " ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));" - ] - }, - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "### Mimikatz" - ] - }, - { - "cell_type": "code", - "execution_count": 7, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-21T18:30:01.383334Z", - "iopub.status.busy": "2020-10-21T18:30:01.383060Z", - "iopub.status.idle": "2020-10-21T18:30:03.190514Z", - "shell.execute_reply": "2020-10-21T18:30:03.189720Z", - "shell.execute_reply.started": "2020-10-21T18:30:01.383303Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "04cf984d9740472dba04265122bc549d", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
end_timestart_timecmd_lineentitiesinput_eventtimestamp
02020-09-11 23:45:192020-09-11 23:45:19mimikatz \"\"kerberos::ptt kerberos::golden ker...[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...{'_tenant': 'test', '_time': '1599867919000', ...2020-09-11 23:45:19
12020-09-11 23:45:212020-09-11 23:45:21mimikatz \"\"crypto::capi crypto::cng crypto::c...[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...{'_tenant': 'test', '_time': '1599867921000', ...2020-09-11 23:45:21
22020-09-11 23:45:172020-09-11 23:45:17mimikatz \"\"lsadump::sam lsadump::secrets lsa...[eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZ...{'_tenant': 'test', '_time': '1599867917000', ...2020-09-11 23:45:17
\n", - "
" - ], - "text/plain": [ - " end_time ... timestamp\n", - "0 2020-09-11 23:45:19 ... 2020-09-11 23:45:19\n", - "1 2020-09-11 23:45:21 ... 2020-09-11 23:45:21\n", - "2 2020-09-11 23:45:17 ... 2020-09-11 23:45:17\n", - "\n", - "[3 rows x 6 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 7, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 --parallelism=7\n", - "| from read_text(\"s3://smle-experiments/datasets/ssa/misko_ssa_detections/logAllMimikatzModules.log\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", - " cmd_line=ucast(map_get(input_event, \"process\"), \"string\", null)\n", - "| where cmd_line != null AND (\n", - " match_regex(cmd_line, /(?i)CRYPTO::Certificates/)=true OR\n", - " match_regex(cmd_line, /(?i)CRYPTO::keys/)=true OR\n", - " match_regex(cmd_line, /(?i)kerberos::list/)=true OR\n", - " match_regex(cmd_line, /(?i)kerberos::tgt/)=true OR\n", - " match_regex(cmd_line, /(?i)lsadump::sam/)=true OR\n", - " match_regex(cmd_line, /(?i)lsadump::secrets/)=true OR\n", - " match_regex(cmd_line, /(?i)lsadump::cache/)=true OR\n", - " match_regex(cmd_line, /(?i)lsadump::lsa/)=true OR\n", - " match_regex(cmd_line, /(?i)lsadump::trust/)=true OR\n", - " match_regex(cmd_line, /(?i)lsadump::backupkeys/)=true \n", - " )\n", - "| eval start_time = timestamp,\n", - " end_time = timestamp,\n", - " entities = mvappend( ucast(map_get(input_event, \"dest_user_id\"), \"string\", null), \n", - " ucast(map_get(input_event, \"dest_device_id\"), \"string\", null));" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "metadata": {}, - "outputs": [], - "source": [] - } - ], - "metadata": { - "kernelspec": { - "display_name": "SPL2", - "language": "SPL", - "name": "spl2" - }, - "language_info": { - "mimetype": "text/spl", - "name": "SPL" - } - }, - "nbformat": 4, - "nbformat_minor": 4 -} diff --git a/notebooks/train_and_publish_phishing_email_model.ipynb b/notebooks/train_and_publish_phishing_email_model.ipynb deleted file mode 100644 index b78a41adf2..0000000000 --- a/notebooks/train_and_publish_phishing_email_model.ipynb +++ /dev/null @@ -1,564 +0,0 @@ -{ - "cells": [ - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "## Train Model" - ] - }, - { - "cell_type": "code", - "execution_count": 1, - "metadata": {}, - "outputs": [], - "source": [ - "import numpy as np\n", - "import pandas as pd\n", - "\n", - "from tensorflow.keras.layers import Dense, Embedding, LSTM, SpatialDropout1D\n", - "from tensorflow.keras.models import Sequential\n", - "from tensorflow.keras.callbacks import EarlyStopping\n", - "from tensorflow.keras import metrics" - ] - }, - { - "cell_type": "code", - "execution_count": 2, - "metadata": {}, - "outputs": [], - "source": [ - "maxLen = 128\n", - "epochs = 50\n", - "dim_embedding = 50\n", - "batch_size = 256\n", - "dropout_rate = 0.25\n", - "num_LSTM_cell = 64\n", - "trainDataFileName = 's3://smle-experiments/datasets/phishing_email/train.json'" - ] - }, - { - "cell_type": "code", - "execution_count": 3, - "metadata": {}, - "outputs": [], - "source": [ - "xTrain = []\n", - "yTrain = []\n", - "df = pd.read_json(trainDataFileName, lines = True)\n", - "for idx, row in df.iterrows():\n", - " label = np.zeros(1)\n", - " if row['isPhishing'] == 'True':\n", - " label[0] = 1\n", - " yTrain.append(label)\n", - " aMessage = row['From'] + ' ' + row['Subject'] + ' ' + row['Content']\n", - " anEvent = np.array([32]*maxLen)\n", - " p = 0\n", - " for c in aMessage:\n", - " v = ord(c)\n", - " if v < 32 or v > 126:\n", - " continue\n", - " anEvent[p] = v\n", - " p += 1\n", - " if p >= maxLen:\n", - " break\n", - " xTrain.append(anEvent)\n", - "xTrain = np.array(xTrain)\n", - "yTrain = np.array(yTrain)" - ] - }, - { - "cell_type": "code", - "execution_count": 4, - "metadata": {}, - "outputs": [ - { - "name": "stdout", - "output_type": "stream", - "text": [ - "WARNING:tensorflow:From /opt/conda/lib/python3.7/site-packages/tensorflow_core/python/keras/initializers.py:119: calling RandomUniform.__init__ (from tensorflow.python.ops.init_ops) with dtype is deprecated and will be removed in a future version.\n", - "Instructions for updating:\n", - "Call initializer instance with the dtype argument instead of passing it to the constructor\n", - "WARNING:tensorflow:From /opt/conda/lib/python3.7/site-packages/tensorflow_core/python/ops/resource_variable_ops.py:1630: calling BaseResourceVariable.__init__ (from tensorflow.python.ops.resource_variable_ops) with constraint is deprecated and will be removed in a future version.\n", - "Instructions for updating:\n", - "If using Keras pass *_constraint arguments to layers.\n", - "WARNING:tensorflow:From /opt/conda/lib/python3.7/site-packages/tensorflow_core/python/ops/nn_impl.py:183: where (from tensorflow.python.ops.array_ops) is deprecated and will be removed in a future version.\n", - "Instructions for updating:\n", - "Use tf.where in 2.0, which has the same broadcast rule as np.where\n", - "Train on 40000 samples, validate on 10000 samples\n", - "Epoch 1/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.1514 - acc: 0.9740 - val_loss: 0.0912 - val_acc: 0.9817\n", - "Epoch 2/50\n", - "40000/40000 [==============================] - 44s 1ms/sample - loss: 0.0990 - acc: 0.9796 - val_loss: 0.0904 - val_acc: 0.9817\n", - "Epoch 3/50\n", - "40000/40000 [==============================] - 43s 1ms/sample - loss: 0.0884 - acc: 0.9796 - val_loss: 0.0726 - val_acc: 0.9828\n", - "Epoch 4/50\n", - "40000/40000 [==============================] - 44s 1ms/sample - loss: 0.0726 - acc: 0.9798 - val_loss: 0.0640 - val_acc: 0.9830\n", - "Epoch 5/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0667 - acc: 0.9812 - val_loss: 0.0621 - val_acc: 0.9855\n", - "Epoch 6/50\n", - "40000/40000 [==============================] - 44s 1ms/sample - loss: 0.0665 - acc: 0.9813 - val_loss: 0.0598 - val_acc: 0.9849\n", - "Epoch 7/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0651 - acc: 0.9816 - val_loss: 0.0529 - val_acc: 0.9824\n", - "Epoch 8/50\n", - "40000/40000 [==============================] - 44s 1ms/sample - loss: 0.0532 - acc: 0.9830 - val_loss: 0.0393 - val_acc: 0.9889\n", - "Epoch 9/50\n", - "40000/40000 [==============================] - 44s 1ms/sample - loss: 0.0474 - acc: 0.9844 - val_loss: 0.0428 - val_acc: 0.9891\n", - "Epoch 10/50\n", - "40000/40000 [==============================] - 44s 1ms/sample - loss: 0.0419 - acc: 0.9891 - val_loss: 0.0359 - val_acc: 0.9912\n", - "Epoch 11/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0385 - acc: 0.9886 - val_loss: 0.0271 - val_acc: 0.9922\n", - "Epoch 12/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0369 - acc: 0.9894 - val_loss: 0.0251 - val_acc: 0.9937\n", - "Epoch 13/50\n", - "40000/40000 [==============================] - 46s 1ms/sample - loss: 0.0299 - acc: 0.9921 - val_loss: 0.0255 - val_acc: 0.9933\n", - "Epoch 14/50\n", - "40000/40000 [==============================] - 46s 1ms/sample - loss: 0.0242 - acc: 0.9942 - val_loss: 0.0181 - val_acc: 0.9948\n", - "Epoch 15/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0210 - acc: 0.9958 - val_loss: 0.0195 - val_acc: 0.9957\n", - "Epoch 16/50\n", - "40000/40000 [==============================] - 44s 1ms/sample - loss: 0.0179 - acc: 0.9961 - val_loss: 0.0146 - val_acc: 0.9965\n", - "Epoch 17/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0168 - acc: 0.9964 - val_loss: 0.0147 - val_acc: 0.9969\n", - "Epoch 18/50\n", - "40000/40000 [==============================] - 43s 1ms/sample - loss: 0.0179 - acc: 0.9959 - val_loss: 0.0125 - val_acc: 0.9968\n", - "Epoch 19/50\n", - "40000/40000 [==============================] - 46s 1ms/sample - loss: 0.0262 - acc: 0.9909 - val_loss: 0.0168 - val_acc: 0.9971\n", - "Epoch 20/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0169 - acc: 0.9961 - val_loss: 0.0128 - val_acc: 0.9971\n", - "Epoch 21/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0163 - acc: 0.9962 - val_loss: 0.0134 - val_acc: 0.9966\n", - "Epoch 22/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0165 - acc: 0.9966 - val_loss: 0.0121 - val_acc: 0.9971\n", - "Epoch 23/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0143 - acc: 0.9967 - val_loss: 0.0115 - val_acc: 0.9970\n", - "Epoch 24/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0266 - acc: 0.9909 - val_loss: 0.0170 - val_acc: 0.9971\n", - "Epoch 25/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0158 - acc: 0.9964 - val_loss: 0.0119 - val_acc: 0.9971\n", - "Epoch 26/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0190 - acc: 0.9951 - val_loss: 0.0146 - val_acc: 0.9959\n", - "Epoch 27/50\n", - "40000/40000 [==============================] - 46s 1ms/sample - loss: 0.0173 - acc: 0.9956 - val_loss: 0.0134 - val_acc: 0.9973\n", - "Epoch 28/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0120 - acc: 0.9970 - val_loss: 0.0130 - val_acc: 0.9972\n", - "Epoch 29/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0125 - acc: 0.9970 - val_loss: 0.0123 - val_acc: 0.9973\n", - "Epoch 30/50\n", - "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0121 - acc: 0.9970 - val_loss: 0.0127 - val_acc: 0.9969\n" - ] - } - ], - "source": [ - "model = Sequential()\n", - "model.add(Embedding(128, dim_embedding, input_length=maxLen))\n", - "model.add(SpatialDropout1D(dropout_rate))\n", - "model.add(LSTM(num_LSTM_cell, dropout=dropout_rate, recurrent_dropout=dropout_rate))\n", - "model.add(Dense(1, activation='sigmoid'))\n", - "model.compile(optimizer='adam', loss='binary_crossentropy', metrics=['accuracy'])\n", - "history = model.fit(xTrain, yTrain, epochs=epochs, batch_size=batch_size, validation_split=0.2, \n", - " callbacks=[EarlyStopping(monitor='val_loss',patience=7, min_delta=0.00001)])" - ] - }, - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "## Publish Model" - ] - }, - { - "cell_type": "code", - "execution_count": 5, - "metadata": {}, - "outputs": [], - "source": [ - "import os\n", - "import smle\n", - "import warnings\n", - "\n", - "warnings.filterwarnings('ignore')\n", - "from smle.context import Context\n", - "cwd = os.getcwd()\n", - "\n", - "config = { \n", - " 'username': '',\n", - " \n", - " 'model_storage_type': 's3', \n", - " 'model_storage_address': \"s3.us-west-2.amazonaws.com\",\n", - " 'model_storage_bucket': 'smle-experiments',\n", - " 'model_storage_access_key': '',\n", - " 'model_storage_secret_key': '',\n", - " 'model_storage_secure': False,\n", - "}\n", - "smle_context = Context(config)\n", - "\n", - "%load_ext spl2_kernel" - ] - }, - { - "cell_type": "code", - "execution_count": 6, - "metadata": {}, - "outputs": [ - { - "name": "stdout", - "output_type": "stream", - "text": [ - "WARNING:tensorflow:From /opt/conda/lib/python3.7/site-packages/smle/onnx.py:88: export_saved_model (from tensorflow.python.keras.saving.saved_model_experimental) is deprecated and will be removed in a future version.\n", - "Instructions for updating:\n", - "Please use `model.save(..., save_format=\"tf\")` or `tf.keras.models.save_model(..., save_format=\"tf\")`.\n", - "WARNING:tensorflow:From /opt/conda/lib/python3.7/site-packages/tensorflow_core/python/ops/init_ops.py:97: calling GlorotUniform.__init__ (from tensorflow.python.ops.init_ops) with dtype is deprecated and will be removed in a future version.\n", - "Instructions for updating:\n", - "Call initializer instance with the dtype argument instead of passing it to the constructor\n", - "WARNING:tensorflow:From /opt/conda/lib/python3.7/site-packages/tensorflow_core/python/ops/init_ops.py:97: calling Orthogonal.__init__ (from tensorflow.python.ops.init_ops) with dtype is deprecated and will be removed in a future version.\n", - "Instructions for updating:\n", - "Call initializer instance with the dtype argument instead of passing it to the constructor\n", - "WARNING:tensorflow:From /opt/conda/lib/python3.7/site-packages/tensorflow_core/python/ops/init_ops.py:97: calling Zeros.__init__ (from tensorflow.python.ops.init_ops) with dtype is deprecated and will be removed in a future version.\n", - "Instructions for updating:\n", - "Call initializer instance with the dtype argument instead of passing it to the constructor\n", - "WARNING:tensorflow:From /opt/conda/lib/python3.7/site-packages/tensorflow_core/python/saved_model/signature_def_utils_impl.py:253: build_tensor_info (from tensorflow.python.saved_model.utils_impl) is deprecated and will be removed in a future version.\n", - "Instructions for updating:\n", - "This function will only be available through the v1 compatibility library as tf.compat.v1.saved_model.utils.build_tensor_info or tf.compat.v1.saved_model.build_tensor_info.\n", - "INFO:tensorflow:Signatures INCLUDED in export for Classify: None\n", - "INFO:tensorflow:Signatures INCLUDED in export for Regress: None\n", - "INFO:tensorflow:Signatures INCLUDED in export for Predict: None\n", - "INFO:tensorflow:Signatures INCLUDED in export for Train: ['train']\n", - "INFO:tensorflow:Signatures INCLUDED in export for Eval: None\n", - "WARNING:tensorflow:Export includes no default signature!\n", - "INFO:tensorflow:No assets to save.\n", - "INFO:tensorflow:No assets to write.\n", - "INFO:tensorflow:Signatures INCLUDED in export for Classify: None\n", - "INFO:tensorflow:Signatures INCLUDED in export for Regress: None\n", - "INFO:tensorflow:Signatures INCLUDED in export for Predict: None\n", - "INFO:tensorflow:Signatures INCLUDED in export for Train: None\n", - "INFO:tensorflow:Signatures INCLUDED in export for Eval: ['eval']\n", - "WARNING:tensorflow:Export includes no default signature!\n", - "INFO:tensorflow:No assets to save.\n", - "INFO:tensorflow:No assets to write.\n", - "INFO:tensorflow:Signatures INCLUDED in export for Classify: None\n", - "INFO:tensorflow:Signatures INCLUDED in export for Regress: None\n", - "INFO:tensorflow:Signatures INCLUDED in export for Predict: ['serving_default']\n", - "INFO:tensorflow:Signatures INCLUDED in export for Train: None\n", - "INFO:tensorflow:Signatures INCLUDED in export for Eval: None\n", - "INFO:tensorflow:No assets to save.\n", - "INFO:tensorflow:No assets to write.\n", - "INFO:tensorflow:SavedModel written to: /tmp/phishing_email/saved_model.pb\n" - ] - } - ], - "source": [ - "model_path = \"models/phishing_email\"\n", - "model_name = \"phishing_email\"\n", - "\n", - "!rm -rf /tmp/{model_name}\n", - "sample_data = pd.read_csv('s3://smle-experiments/datasets/phishing_email/sample_file.csv')\n", - "smle_context.publish(model, model_name=model_name, path = model_path, sample= sample_data)" - ] - }, - { - "cell_type": "code", - "execution_count": 7, - "metadata": {}, - "outputs": [ - { - "name": "stdout", - "output_type": "stream", - "text": [ - "Metadata:\n", - "{'inputFields': [{'name': 'embedding_input:0',\n", - " 'size': 128,\n", - " 'type': 'floatTensor'}],\n", - " 'modelName': 'phishing_email',\n", - " 'outputFields': [{'name': 'dense/Sigmoid:0',\n", - " 'size': 1,\n", - " 'type': 'floatTensor'}]}\n", - "\n", - "ONNX model specs:\n", - "{'inputs': [{'name': 'embedding_input:0',\n", - " 'shape': ['unk__236', 128],\n", - " 'type': 'tensor(float)'}],\n", - " 'outputs': [{'name': 'dense/Sigmoid:0',\n", - " 'shape': ['unk__237', 1],\n", - " 'type': 'tensor(float)'}]}\n" - ] - } - ], - "source": [ - "import json\n", - "import onnxruntime as rt\n", - "from pprint import pprint\n", - "\n", - "\n", - "def inspect_model(dir_path, model_name):\n", - "\n", - " metadata = json.load(open(dir_path + \"metadata.json\"))\n", - " \n", - " print(\"Metadata:\")\n", - " pprint(metadata)\n", - " print()\n", - " \n", - " model_path = dir_path + model_name + \".onnx\"\n", - " sess = rt.InferenceSession(model_path)\n", - "\n", - " onnx_inputs = sess.get_inputs()\n", - " onnx_outputs = sess.get_outputs()\n", - "\n", - " inputs = [{\"name\": node.name, \"type\": node.type, \"shape\": node.shape} for node in onnx_inputs]\n", - " outputs = [{\"name\": node.name, \"type\": node.type, \"shape\": node.shape} for node in onnx_outputs]\n", - " onnx_model_specs = {\"inputs\": inputs, \"outputs\": outputs}\n", - " print(\"ONNX model specs:\")\n", - " \n", - " pprint(onnx_model_specs)\n", - "\n", - "\n", - "inspect_model(\"/tmp/\", model_name)" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "metadata": {}, - "outputs": [], - "source": [] - }, - { - "cell_type": "code", - "execution_count": 8, - "metadata": {}, - "outputs": [], - "source": [ - "%%spl2_add_params from_python\n", - "phishing_email = dict(\n", - " model_path = \"s3://smle-experiments/models/phishing_email\",\n", - " model_name = \"phishing_email\",\n", - " input_field = \"embedding_input:0\",\n", - ")" - ] - }, - { - "cell_type": "code", - "execution_count": 9, - "metadata": {}, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "6aa0cfe6342a4e59b0ff9a68f1de5596", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
eventLineprobability
0karem ahmed <karemahmed-18@hotmail.fr> PLEA...[0.9720325]
1nkomo robert <nkomo002@5fm.za.com> FAMILY R...[0.9768889]
2Mrs Mariam Taylor <familyboxjanetfamilybo...[0.9780622999999999]
3Mr.Fred Chima <fredi@fastermail.com> busi...[0.97669697]
4Alexander Afadia <eeaesq@123.com> Please repl...[0.9775347999999999]
.........
82Comfort Somba. <comfort_somba11@yahoo.fr> F...[0.97327405]
83bintu pat <pat_bintu004@hotmail.com> TRUSTI...[0.96824765]
84FR RICHARD DAVID <unofice@katamail.com> FRO...[0.96306074]
85<joseph_m333@micasilla.net> Farmers Greetings...[0.97275084]
86MRS. LARISA SOSNITSKAYA <larisasosnkayapawou...[0.9751048999999999]
\n", - "

87 rows × 2 columns

\n", - "
" - ], - "text/plain": [ - " eventLine probability\n", - "0 karem ahmed PLEA... [0.9720325]\n", - "1 nkomo robert FAMILY R... [0.9768889]\n", - "2 Mrs Mariam Taylor busi... [0.97669697]\n", - "4 Alexander Afadia Please repl... [0.9775347999999999]\n", - ".. ... ...\n", - "82 Comfort Somba. F... [0.97327405]\n", - "83 bintu pat TRUSTI... [0.96824765]\n", - "84 FR RICHARD DAVID FRO... [0.96306074]\n", - "85 Farmers Greetings... [0.97275084]\n", - "86 MRS. LARISA SOSNITSKAYA " - ] - }, - "execution_count": 9, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "%%spl2 -q phishing_email\n", - "| from read_json(\"s3://smle-experiments/datasets/phishing_email/test.json\")\n", - "| eval eventLine=concat(From, \" \", Subject, \" \", Content, \" \", \" \")\n", - "| eval mapC = {\" \":32,\"!\":33,\"\\\"\":34,\"#\":35,\"$$\":36,\"%\":37,\"&\":38,\"'\":39,\"(\":40,\")\":41,\"*\":42,\"+\":43,\",\":44,\"-\":45,\".\":46,\"/\":47,\"0\":48,\"1\":49,\"2\":50,\"3\":51,\"4\":52,\"5\":53,\"6\":54,\"7\":55,\"8\":56,\"9\":57,\":\":58,\";\":59,\"<\":60,\"=\":61,\">\":62,\"?\":63,\"@\":64,\"A\":65,\"B\":66,\"C\":67,\"D\":68,\"E\":69,\"F\":70,\"G\":71,\"H\":72,\"I\":73,\"J\":74,\"K\":75,\"L\":76,\"M\":77,\"N\":78,\"O\":79,\"P\":80,\"Q\":81,\"R\":82,\"S\":83,\"T\":84,\"U\":85,\"V\":86,\"W\":87,\"X\":88,\"Y\":89,\"Z\":90,\"[\":91,\"\\\\\":92,\"]\":93,\"^\":94,\"_\":95,\"`\":96,\"a\":97,\"b\":98,\"c\":99,\"d\":100,\"e\":101,\"f\":102,\"g\":103,\"h\":104,\"i\":105,\"j\":106,\"k\":107,\"l\":108,\"m\":109,\"n\":110,\"o\":111,\"p\":112,\"q\":113,\"r\":114,\"s\":115,\"t\":116,\"u\":117,\"v\":118,\"w\":119,\"x\":120,\"y\":121,\"z\":122,\"{\":123,\"|\":124,\"}\":125,\"~\":126}\n", - "| eval 'embedding_input:0' = for_each(\n", - " iterator(mvrange(1,129), \"i\"),\n", - " cast(map_get(mapC, substr(eventLine, i, 1)), \"float\") )\n", - "| apply_model connection_id=\"\" path=\"$model_path\" name=\"$model_name\" \n", - "| rename 'dense/Sigmoid:0' AS probability \n", - "| where mvindex(probability, 0) > 0.5 \n", - "| select eventLine, probability \n", - ";" - ] - }, - { - "cell_type": "code", - "execution_count": 10, - "metadata": {}, - "outputs": [], - "source": [ - "df = _.df" - ] - }, - { - "cell_type": "code", - "execution_count": 11, - "metadata": { - "scrolled": true - }, - "outputs": [ - { - "data": { - "text/plain": [ - "\" karem ahmed PLEASE VERY URGENT. FROM THE DESK OF Mr,KAREM AHMED.BILL AND EXCHANGE MANAGER,BANK OF AFRICA (B.O.A) OUAGADOUGOU,BURKINA FASO WEST AFRICA.PHONE CONTACT 00226.78.89.77.34DEAR FRIEND,I know you may be surprise to recieve this e-mail ; I got your contact address from the internet while I was searching for my friend that has similar name with you.I am the manager of bill and exchange BANK OF AFRICA (B.O.A) at foreign remittance department.There is a business I would want you to champion for me, in my department I discovered an abandoned sum of ($31.500.000 U.S) thirty one million five hundred thousands US dollars)In an account that belongs to one of our foreign customer who died along with his entire family on 25TH JULY, 2000 CONCORDE PLANE CRASH [Flight AF4590] with the whole passengers aboard. The name of the deceased man was(MR.ANDREAS SCHRANNER from Munich Germany)N.B. In other for you to believe me honestly, visit the web site to enable you know whether we can work together, below is the website. http://news.bbc.co.uk/1/hi/world/europe/859479.stmYou have to understand that I come crossed this huge amount of money when I was arranging the departmental customers file to submit to the bank management for the annual audit of the year.Since we got information about his death, we have been expecting his next of kin to come over and claim his money because we cannot release it unless somebody applies for it as next of kin or relation to the deceased as indicated in our banking guidelines, but unfortunately we learnt that all his supposed next of kin's or relation died alongside with him at the plane crash leaving nobody behind for the claim.It is therefore upon this discovery that I now decided to make this business proposal to you and release the money to you as the next of kin or relation to the deceased for safety and subsequent disbursement since nobody is coming for it and I dont want this money to go into the Bank treasury as unclaimed Bill.The Banking law and guideline here stipulates that if such money remained unclaimed after some years, the money will be transferred into the Bank treasury as unclaimed fund.The request of foreigner as next of kin in this business is occasioned by the fact that the customer was a foreigner and a Burkina citizen cannot stand as next of kin to a foreigner.In fact I could have done this deal alone but because of my position in this country as a civil servant (A Banker), we are not allowed to operate any foreign account and would eventually raise an eye brow on my side during the time of transfer because I work in the same bank. This is the actual reason why it will require a second party or fellow who will forward claims as the next of kin to the Bank and also present a foreign account where he will need the money to be re-transferred into on his request as it may be after due verification and clarification by the correspondent branch of the bank where the whole money will be remitted from to your own designation bank account.I dont want this money to go into the Bank treasury as unclaimed Bill, I agree that 30 % of this money will be for you as foreign partner, in respect to the provision of a foreign account, 10 % will be set aside for expenses incurred during the business and 60 % would be for me. There after I will visit your country for disbursement according to the percentages indicated. Therefore to enable immediate transfer of this fund to you as arranged, you must apply first to the bank as relations or next of kin of the deceased indicating your bank name, your bank account number, your private telephone and fax number for easy and effective communication and location where in the money will be remitted.All modalities of this transaction have been carefully worked out and once started will not take more than fourteen (14) working days, with your full support.This transaction is 100% risk free. it involve no any implication and no any precaution there after.Upon receipt of your reply, I will send to you by fax or email the text of the application. I will not fail to bring to your notice that this transaction is hitch free and that you should not entertain any atom of fear as all required arrangements have been made for the transfer.You should contact me immediately as soon as you receive this letterreply to thi box. at;Trusting to hear from you immediately.Yours faithfully,Mr,KAREM AHMEDBill and exchange manager,BANK OF AFRICA_________________________________________________________________Personnalisez votre Messenger avec Live.com http://www.windowslive.fr/livecom/ \"" - ] - }, - "execution_count": 11, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "df.iloc[0]['eventLine']" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "metadata": {}, - "outputs": [], - "source": [] - } - ], - "metadata": { - "kernelspec": { - "display_name": "Python 3", - "language": "python", - "name": "python3" - }, - "language_info": { - "codemirror_mode": { - "name": "ipython", - "version": 3 - }, - "file_extension": ".py", - "mimetype": "text/x-python", - "name": "python", - "nbconvert_exporter": "python", - "pygments_lexer": "ipython3", - "version": "3.7.6" - } - }, - "nbformat": 4, - "nbformat_minor": 4 -} diff --git a/notebooks/unit_test_prohibited_apps_spawning_cmdprompt.ipynb b/notebooks/unit_test_prohibited_apps_spawning_cmdprompt.ipynb deleted file mode 100644 index 94160fe672..0000000000 --- a/notebooks/unit_test_prohibited_apps_spawning_cmdprompt.ipynb +++ /dev/null @@ -1,204 +0,0 @@ -{ - "cells": [ - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "# Detect Prohibited Applications Spawning cmd exe Unit Test\n", - "\n", - "#### This search looks for executions of cmd.exe spawned by a process that is often abused by attackers and that does not typically launch cmd.exe. This is a SPL2 implementation of the rule `Detect Prohibited Applications Spawning cmd.exe`\n", - "\n", - "Source: https://github.com/splunk/security-content/blob/develop/detections/endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml" - ] - }, - { - "cell_type": "code", - "execution_count": 92, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-15T00:21:43.611728Z", - "iopub.status.busy": "2020-10-15T00:21:43.611411Z", - "iopub.status.idle": "2020-10-15T00:21:43.615239Z", - "shell.execute_reply": "2020-10-15T00:21:43.614712Z", - "shell.execute_reply.started": "2020-10-15T00:21:43.611700Z" - } - }, - "outputs": [], - "source": [ - "import json\n", - "data='{\"process_path\":\"c:\\\\\\windows\\\\\\system32\",\"process_name\":\"cmd.exe\",\"process\":\"C:\\\\\\Windows\\\\\\system32\\\\\\cmd.exe\",\"parent_process_name\":\"C:\\\\\\Program Files\\\\\\Microsoft Office\\\\\\winword.exe\",\"dest_user_id\":\"eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZmFjdCI6ImFkbWluaXN0cmF0b3IiLCJwcmltYXJ5QXJ0aWZhY3RUeXBlIjoiV0lORE9XU19BQ0NPVU5UX05BTUUifQ\",\"dest_device_id\":\"eyJlbnRpdHlUeXBlIjoiREVWSUNFIiwicHJpbWFyeUFydGlmYWN0Ijoid2luLWRjLTY1NjUwNzEiLCJwcmltYXJ5QXJ0aWZhY3RUeXBlIjoiRE5TIn0\",\"_time\":\"1602004409000\"}'\n", - "json.loads(data)\n", - "with open(\"detect_prohibited_applications_spawning_cmd_exe.json\", \"w\") as outfile:\n", - " outfile.write(data)" - ] - }, - { - "cell_type": "code", - "execution_count": 94, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-15T00:22:58.225618Z", - "iopub.status.busy": "2020-10-15T00:22:58.225357Z", - "iopub.status.idle": "2020-10-15T00:22:59.362013Z", - "shell.execute_reply": "2020-10-15T00:22:59.361508Z", - "shell.execute_reply.started": "2020-10-15T00:22:58.225596Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "c2d2b32468a04f8a8bb7eafd174e5c5d", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
start_timedest_device_idfield0entitiesprocess_nameend_timedest_user_idparent_processbodyvalueinput_eventtimestamp
02020-10-06 17:13:29eyJlbnRpdHlUeXBlIjoiREVWSUNFIiwicHJpbWFyeUFydG...winword.exe[eyJlbnRpdHlUeXBlIjoiREVWSUNFIiwicHJpbWFyeUFyd...cmd.exe2020-10-06 17:13:29eyJlbnRpdHlUeXBlIjoiVVNFUiIsInByaW1hcnlBcnRpZm...c:\\program files\\microsoft office\\winword.exeTBD{\"process_path\":\"c:\\\\windows\\\\system32\",\"proce...{'process_path': 'c:\\windows\\system32', 'proce...2020-10-06 17:13:29
\n", - "
" - ], - "text/plain": [ - " start_time ... timestamp\n", - "0 2020-10-06 17:13:29 ... 2020-10-06 17:13:29\n", - "\n", - "[1 rows x 12 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 94, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "| from read_text(\"s3://smle-experiments/datasets/ssa/detect_prohibited_applications_spawning_cmd_exe.json\")\n", - "| eval input_event=from_json_object(value)\n", - "\n", - "| eval timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null))\n", - "| eval process_name=ucast(map_get(input_event, \"process_name\"), \"string\", null),\n", - "parent_process=lower(ucast(map_get(input_event, \"parent_process_name\"), \"string\", null)),\n", - "dest_user_id=ucast(map_get(input_event, \"dest_user_id\"), \"string\", null),\n", - "dest_device_id=ucast(map_get(input_event, \"dest_device_id\"), \"string\", null)\n", - "| where process_name=\"cmd.exe\"\n", - "| rex field=parent_process \"(?[^\\\\\\\\]+)$\"\n", - "| where field0=\"winword.exe\" OR\n", - " field0=\"excel.exe\" OR\n", - " field0=\"outlook.exe\" OR\n", - " field0=\"powerpnt.exe\" OR\n", - " field0=\"visio.exe\" OR\n", - " field0=\"mspub.exe\" OR\n", - " field0=\"acrobat.exe\" OR\n", - " field0=\"acrord32.exe\" OR\n", - " field0=\"chrome.exe\" OR\n", - " field0=\"iexplore.exe\" OR\n", - " field0=\"opera.exe\" OR\n", - " field0=\"firefox.exe\" OR\n", - " field0=\"java.exe\" OR\n", - " field0=\"powershell.exe\"\n", - "| eval start_time=timestamp,\n", - "end_time=timestamp,\n", - "entities=mvappend(dest_device_id, dest_user_id),\n", - "body=\"TBD\";" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "metadata": {}, - "outputs": [], - "source": [] - } - ], - "metadata": { - "kernelspec": { - "display_name": "SPL2", - "language": "SPL", - "name": "spl2" - }, - "language_info": { - "mimetype": "text/spl", - "name": "SPL" - } - }, - "nbformat": 4, - "nbformat_minor": 4 -} diff --git a/notebooks/unusual_lolbas_in_short_period_of_time.ipynb b/notebooks/unusual_lolbas_in_short_period_of_time.ipynb deleted file mode 100644 index d277a654e0..0000000000 --- a/notebooks/unusual_lolbas_in_short_period_of_time.ipynb +++ /dev/null @@ -1,268 +0,0 @@ -{ - "cells": [ - { - "cell_type": "markdown", - "metadata": {}, - "source": [ - "# More than usual number of LOLBAS applications in short time period\n", - "\n", - "Attacker activity may compromise executing several LOLBAS applications in conjunction to accomplish their objectives. We are looking for more than usual LOLBAS applications over a window of time, by building profiles per machine.\n" - ] - }, - { - "cell_type": "code", - "execution_count": 3, - "metadata": { - "execution": { - "iopub.execute_input": "2020-10-15T21:42:08.429572Z", - "iopub.status.busy": "2020-10-15T21:42:08.429312Z", - "iopub.status.idle": "2020-10-15T21:42:15.742444Z", - "shell.execute_reply": "2020-10-15T21:42:15.741830Z", - "shell.execute_reply.started": "2020-10-15T21:42:08.429549Z" - } - }, - "outputs": [ - { - "data": { - "application/vnd.jupyter.widget-view+json": { - "model_id": "c27fe9ebed854de3b9d45c5f643cbbdb", - "version_major": 2, - "version_minor": 0 - }, - "text/plain": [ - "HBox(children=(HTML(value=''), FloatProgress(value=0.0, max=5.0), HTML(value='')))" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - " Finished. " - ] - }, - { - "data": { - "text/html": [ - "
\n", - "\n", - "\n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - " \n", - "
start_timewindow_triggerentitiesquantileend_timewindow_startlabelbodydevicelolbas_countertimestamp
02020-09-24 17:10:001600967399999[5gUXDbXvVfgC/FEpZOFUaA==]12020-09-24 17:10:001600967100000TrueTBD5gUXDbXvVfgC/FEpZOFUaA==72020-09-24 17:10:00
12020-09-24 17:45:001600969499999[5gUXDbXvVfgC/FEpZOFUaA==]12020-09-24 17:45:001600969200000TrueTBD5gUXDbXvVfgC/FEpZOFUaA==92020-09-24 17:45:00
22020-09-24 17:55:001600970099999[IaNYgFTNQvyVmJNuPr58dQ==]12020-09-24 17:55:001600969800000TrueTBDIaNYgFTNQvyVmJNuPr58dQ==92020-09-24 17:55:00
32020-09-24 18:00:001600970399999[lQ+9FBHxYQK/q8qXcrTE9A==]12020-09-24 18:00:001600970100000TrueTBDlQ+9FBHxYQK/q8qXcrTE9A==92020-09-24 18:00:00
42020-09-24 22:20:001600985999999[zMnUW93edd+Q+ovwebxbRw==]12020-09-24 22:20:001600985700000TrueTBDzMnUW93edd+Q+ovwebxbRw==52020-09-24 22:20:00
52020-09-24 23:30:001600990199999[ZTQ/ltGlScpA4WGbfRJ0Xg==]12020-09-24 23:30:001600989900000TrueTBDZTQ/ltGlScpA4WGbfRJ0Xg==52020-09-24 23:30:00
62020-09-25 14:25:001601043899999[lQ+9FBHxYQK/q8qXcrTE9A==]12020-09-25 14:25:001601043600000TrueTBDlQ+9FBHxYQK/q8qXcrTE9A==122020-09-25 14:25:00
72020-09-26 05:05:001601096699999[OWUYaWKrJeuOY71+TXoqiw==]12020-09-26 05:05:001601096400000TrueTBDOWUYaWKrJeuOY71+TXoqiw==382020-09-26 05:05:00
\n", - "
" - ], - "text/plain": [ - " start_time window_trigger ... lolbas_counter timestamp\n", - "0 2020-09-24 17:10:00 1600967399999 ... 7 2020-09-24 17:10:00\n", - "1 2020-09-24 17:45:00 1600969499999 ... 9 2020-09-24 17:45:00\n", - "2 2020-09-24 17:55:00 1600970099999 ... 9 2020-09-24 17:55:00\n", - "3 2020-09-24 18:00:00 1600970399999 ... 9 2020-09-24 18:00:00\n", - "4 2020-09-24 22:20:00 1600985999999 ... 5 2020-09-24 22:20:00\n", - "5 2020-09-24 23:30:00 1600990199999 ... 5 2020-09-24 23:30:00\n", - "6 2020-09-25 14:25:00 1601043899999 ... 12 2020-09-25 14:25:00\n", - "7 2020-09-26 05:05:00 1601096699999 ... 38 2020-09-26 05:05:00\n", - "\n", - "[8 rows x 11 columns]" - ] - }, - "metadata": {}, - "output_type": "display_data" - }, - { - "name": "stdout", - "output_type": "stream", - "text": [ - "\n" - ] - }, - { - "data": { - "text/plain": [ - "" - ] - }, - "execution_count": 3, - "metadata": {}, - "output_type": "execute_result" - } - ], - "source": [ - "| from read_text(\"s3://smle-experiments/datasets/ssa/T1059.all.labeled.lolbas-test.json\")\n", - "| select from_json_object(value) as input_event\n", - "| eval timestamp=ucast(map_get(input_event, \"_time\"), \"long\", null)\n", - " | eval device=ucast(map_get(input_event, \"dest_device_id\"), \"string\", null),\n", - " process_name=lower(ucast(map_get(input_event, \"process_name\"), \"string\", null))\n", - " | where process_name==\"regsvcs.exe\" OR process_name==\"ftp.exe\" OR process_name==\"dfsvc.exe\" OR process_name==\"rasautou.exe\" OR process_name==\"schtasks.exe\" OR process_name==\"xwizard.exe\" OR process_name==\"findstr.exe\" OR process_name==\"esentutl.exe\" OR process_name==\"cscript.exe\" OR process_name==\"reg.exe\" OR process_name==\"csc.exe\" OR process_name==\"atbroker.exe\" OR process_name==\"print.exe\" OR process_name==\"pcwrun.exe\" OR process_name==\"vbc.exe\" OR process_name==\"rpcping.exe\" OR process_name==\"wsreset.exe\" OR process_name==\"ilasm.exe\" OR process_name==\"certutil.exe\" OR process_name==\"replace.exe\" OR process_name==\"mshta.exe\" OR process_name==\"bitsadmin.exe\" OR process_name==\"wscript.exe\" OR process_name==\"ieexec.exe\" OR process_name==\"cmd.exe\" OR process_name==\"microsoft.workflow.compiler.exe\" OR process_name==\"runscripthelper.exe\" OR process_name==\"makecab.exe\" OR process_name==\"forfiles.exe\" OR process_name==\"desktopimgdownldr.exe\" OR process_name==\"control.exe\" OR process_name==\"msbuild.exe\" OR process_name==\"register-cimprovider.exe\" OR process_name==\"tttracer.exe\" OR process_name==\"ie4uinit.exe\" OR process_name==\"sc.exe\" OR process_name==\"bash.exe\" OR process_name==\"hh.exe\" OR process_name==\"cmstp.exe\" OR process_name==\"mmc.exe\" OR process_name==\"jsc.exe\" OR process_name==\"scriptrunner.exe\" OR process_name==\"odbcconf.exe\" OR process_name==\"extexport.exe\" OR process_name==\"msdt.exe\" OR process_name==\"diskshadow.exe\" OR process_name==\"extrac32.exe\" OR process_name==\"eventvwr.exe\" OR process_name==\"mavinject.exe\" OR process_name==\"regasm.exe\" OR process_name==\"gpscript.exe\" OR process_name==\"rundll32.exe\" OR process_name==\"regsvr32.exe\" OR process_name==\"regedit.exe\" OR process_name==\"msiexec.exe\" OR process_name==\"gfxdownloadwrapper.exe\" OR process_name==\"presentationhost.exe\" OR process_name==\"regini.exe\" OR process_name==\"wmic.exe\" OR process_name==\"runonce.exe\" OR process_name==\"syncappvpublishingserver.exe\" OR process_name==\"verclsid.exe\" OR process_name==\"psr.exe\" OR process_name==\"infdefaultinstall.exe\" OR process_name==\"explorer.exe\" OR process_name==\"expand.exe\" OR process_name==\"installutil.exe\" OR process_name==\"netsh.exe\" OR process_name==\"wab.exe\" OR process_name==\"dnscmd.exe\" OR process_name==\"at.exe\" OR process_name==\"pcalua.exe\" OR process_name==\"cmdkey.exe\" OR process_name==\"msconfig.exe\" \n", - " | stats count(process_name) as lolbas_counter by device,span(timestamp, 300s) \n", - " | eval lolbas_counter=lolbas_counter*1.0\n", - " | rename window_end as timestamp\n", - " | adaptive_threshold algorithm=\"quantile\" value=\"lolbas_counter\" entity=\"device\" window=2419200000L\n", - " | where label AND quantile>0.99 \n", - " | eval start_time = timestamp, end_time = timestamp, entities = mvappend(device), body = \"TBD\";" - ] - }, - { - "cell_type": "code", - "execution_count": null, - "metadata": {}, - "outputs": [], - "source": [] - } - ], - "metadata": { - "kernelspec": { - "display_name": "SPL2", - "language": "SPL", - "name": "spl2" - }, - "language_info": { - "mimetype": "text/spl", - "name": "SPL" - } - }, - "nbformat": 4, - "nbformat_minor": 4 -} From 1bc7d9b0b0fca4048e0cf34ad32757a40169d9cb Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 13 Jun 2022 15:47:30 -0500 Subject: [PATCH 117/148] Add workbook --- workbooks/splunk_psa_0622.json | 100 +++++++++++++++++++++++++++++++++ 1 file changed, 100 insertions(+) create mode 100644 workbooks/splunk_psa_0622.json diff --git a/workbooks/splunk_psa_0622.json b/workbooks/splunk_psa_0622.json new file mode 100644 index 0000000000..7fa22dc320 --- /dev/null +++ b/workbooks/splunk_psa_0622.json @@ -0,0 +1,100 @@ +{ + "name": "Splunk PSA Hunting 06/22", + "is_default": false, + "phases": [ + { + "name": "SVD-2022-0601", + "order": 1, + "tasks": [ + { + "name": "Identify hosts running pre-9.0 versions of Splunk", + "order": 1, + "description": "This vulnerability affects all installs of Splunk prior to version 9.0. The first thing we need to do is identify which of these hosts are present within an environment. Run the \"ESCU - Splunk Protocol Impersonation Weak Encryption Configuration\" hunting search. \n\n\n Examine the output of the query. Hosts need to be running 9.0 or later in order to have the configuration options available. Additionally, several configuration stanzas need to be set in order to ensure the host properly validates TLS certificates. You can view the full list here: https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk_Python_modules \n\n\n While the hunting search returns the values to check for in server.conf and web.conf, there is also an environment variable set in $SPLUNK_HOME/etc/splunk-launch.conf, which is not available from the search. This needs to be manually checked for (and configured) on each host.", + "playbooks": [], + "actions": ["run query"] + + }, + { + "name": "Look for usage of Default Splunk TLS Certificates", + "order": 2, + "description": "As part of auditing your environment, use data collected from Splunk Stream, Zeek, or a similar data source that provides insight into encrypted traffic and the TLS certificates in use within your environment. You can use the \"ESCU - Splunk Identified SSL TLS Certificates\" hunting search to identify hosts using the default, out of the box Splunk TLS certificates, which should not be considered secure.", + "playbooks": [], + "actions": ["run query"] + }, + { + "name":"Look for lack of encryption", + "order": 3, + "description": "You can use the \"ESCU - Splunk Digital Certificates Lack of Encryption\" search to look for hosts that are forwarding data without the use of TLS. Hosts that are not using TLS to forward data to Splunk are the most likely to need additional scrutiny to ensure these devices are configured in a secure manner. Additionally, you can remove the 'ssl=\"false\"' segment from the beginning of this search in order to get a larger picture of what devices within your environment are forwarding data.", + "playbooks": [], + "actions": ["run query"] + }, + { + "name": "Look for simpleRequest TLS errors", + "order": 4, + "description": "Use the \"ESCU - Splunk Protocol Impersonation Weak Encryption simpleRequest\" hunting search. This search helps you to identify instances in which the SimpleRequest library that ships as part of Splunk's Python failed to validate a certificate.", + "playbooks": [], + "actions": ["run query"] + } + ] + }, + { + "name":"SVD-2022-0602", + "order": 2, + "tasks":[ + { + "name": "Look for usage of Default Splunk TLS Certificates", + "order": 1, + "description":"As part of auditing your environment, use data collected from Splunk Stream, Zeek, or a similar data source that provides insight into encrypted traffic and the TLS certificates in use within your environment. You can use the \"ESCU - Splunk Identified SSL TLS Certificates\" hunting search to identify hosts using the default, out of the box Splunk TLS certificates, which should not be considered secure.", + "playbooks": [], + "actions": ["run query"] + }, + { + "name": "Look for Default TLS Certificate logged errors", + "order": 2, + "description": "Use the \"ESCU - Splunk Protocol Impersonation Weak Encryption SelfSigned\" hunting search. This search helps you identify devices using self signed certificates which emit warnings starting in version 9.0 of Splunk Enterprise.", + "playbooks": [], + "actions": ["run query"] + } + ] + }, + { + "name": "SVD-2022-0603", + "order": 3, + "tasks": [ + { + "name": "Check Splunk Infrastructure versions", + "order": 1, + "description": "Use the \"ESCU - Splunk Digital Certificates Infrastructure Version\" hunting search. This allows you to check the \"SslConfig\" stanza for each host's server.conf as well as its version. For more details about the settings, you can read the docs here: https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk-to-Splunk_communications", + "playbooks": [], + "actions": ["run query"] + } + ] + }, + { + "name": "SVD-2022-0604", + "order": 4, + "tasks": [ + { + "name": "Risky Command Hunting", + "order": 1, + "description": "Use the \"ESCU - Splunk Command and Scripting Interpreter Risky Commands\" hunting search. The Splunk platform includes several SPL commands that can be used to take data that may be restricted by index based RBAC or other means, and make it available to others. This hunting search uses the Splunk Audit datamodel to query the audit trail for your Splunk environment to look for the usage of these commands. The usage of these in particular is not necessarily a sign of trouble and some are used often, but after figuring out what is normal for your environment and who runs what and how often, the data presented will make more sense.", + "playbooks": [], + "actions": ["run query"] + } + ] + }, + { + "name": "SVD-2022-0607", + "order": 5, + "tasks": [ + { + "name": "Forwarder Bundle Download Hunting", + "order": 1, + "description": "Use the \"ESCU - Splunk Process Injection Forwarder Bundle Downloads\" hunting search. This search presents you with all of the apps downloaded by forwarders from your deployment server, as well as what serverclass the clients belong to. This vulnerability relates to unauthenticated clients being able to download forwarder bundles. Look for instances in which apps have been downloaded but a client does not have an associated serverclass.", + "playbooks": [], + "actions": ["run query"] + } + ] + } + ] +} \ No newline at end of file From 42f1e731f7db0f34d264fe0bee2ea0032f8544b2 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 13 Jun 2022 15:47:56 -0500 Subject: [PATCH 118/148] Updated description --- .../splunk_process_injection_forwarder_bundle_downloads.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml index e2de4532d5..5ad85dac05 100644 --- a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml +++ b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml @@ -5,13 +5,12 @@ date: '2022-05-26' author: Lou Stella, Splunk type: Hunting datamodel: [] -description: On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. This hunting search pulls a full list of forwarder bundle downloads where peer is the forwarder, host is the Deployment Server, and then you have a list of the apps downloaded and the serverclasses in which the peer is a member of. You should look for apps or clients that you do not recognize as being part of your environment. +description: On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. This hunting search pulls a full list of forwarder bundle downloads where the peer column is the forwarder, the host column is the Deployment Server, and then you have a list of the apps downloaded and the serverclasses in which the peer is a member of. You should look for apps or clients that you do not recognize as being part of your environment. search: '`splunkd` component="PackageDownloadRestHandler" | stats values(app) values(serverclass) by peer, host | `splunk_process_injection_forwarder_bundle_downloads_filter`' how_to_implement: This hunting search uses native logs produced when a deployment server is within your environment. known_false_positives: None at this time. references: - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html -- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0608.html tags: analytic_story: - Splunk Vulnerabilites From 61a6c11e2dd43a4cc4744ad6da14ef2cae11d01a Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 13 Jun 2022 15:11:44 -0600 Subject: [PATCH 119/148] Update splunk_command_and_scripting_interpreter_delete_usage.yml --- ...ommand_and_scripting_interpreter_delete_usage.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml index 6fdeed8d30..62fc569c6c 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml @@ -13,8 +13,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_delete_usage_filter`' -how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. -known_false_positives: False positives may be present if this command is used as a common practive. Filter as needed. +how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. Acceleration is recommended. +known_false_positives: False positives may be present if this command is used as a common practice. Filter as needed. references: - https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning tags: @@ -27,17 +27,17 @@ tags: - CIS 16 cve: - CVE-2022-32154 - confidence: 100 + confidence: 80 context: - Source:Endpoint dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log - impact: 100 + impact: 90 kill_chain_phases: - Actions on Objectives message: Delete command has ran by $user$ and should be reviewed. mitre_attack_id: - - T1213 + - T1059 nist: - DE.CM observable: @@ -57,6 +57,6 @@ tags: - Search_Activity.user - Search_Activity.savedsearch_name - Search_Activity.search_type - risk_score: 100 + risk_score: 72 security_domain: audit From e30ad6bd31023739486224661e46e9a18f94240e Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 13 Jun 2022 16:17:07 -0500 Subject: [PATCH 120/148] Updated How To Implement --- .../splunk_process_injection_forwarder_bundle_downloads.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml index 5ad85dac05..4372fc3ac5 100644 --- a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml +++ b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml @@ -7,10 +7,11 @@ type: Hunting datamodel: [] description: On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. This hunting search pulls a full list of forwarder bundle downloads where the peer column is the forwarder, the host column is the Deployment Server, and then you have a list of the apps downloaded and the serverclasses in which the peer is a member of. You should look for apps or clients that you do not recognize as being part of your environment. search: '`splunkd` component="PackageDownloadRestHandler" | stats values(app) values(serverclass) by peer, host | `splunk_process_injection_forwarder_bundle_downloads_filter`' -how_to_implement: This hunting search uses native logs produced when a deployment server is within your environment. +how_to_implement: This hunting search uses native logs produced when a deployment server is within your environment. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. known_false_positives: None at this time. references: - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html +- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json tags: analytic_story: - Splunk Vulnerabilites From 5414d530fec12032b17a26da01d1eb889a25e0b2 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 13 Jun 2022 15:18:21 -0600 Subject: [PATCH 121/148] Update splunk_command_and_scripting_interpreter_risky_commands.yml --- ...mand_and_scripting_interpreter_risky_commands.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml index 9d68135295..02faf6770e 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml @@ -7,9 +7,9 @@ type: Hunting datamodel: - Splunk_Audit description: 'The Splunk platform contains built-in search processing language (SPL) safeguards to warn you when you are about to unknowingly run a search that contains commands that might be a security risk. This warning appears when you click a link or type a URL that loads a search that contains risky commands. The warning does not appear when you create ad hoc searches. This warning alerts you to the possibility of unauthorized actions by a malicious user. Unauthorized actions include - - Copying or transferring data (data exfiltration), Deleting data and Overwriting data. - A possible scenario when this might occur is when a malicious person creates a search that includes commands that exfiltrate or damage data. The malicious person then sends an unsuspecting user a link to the search. The URL contains a query string (q) and a search identifier (sid), but the sid is not valid. The malicious person hopes the user will use the link and the search will run. - During analysis, pivot based on user name and filter any user or queries not needed. Adhoc queries found from dashboards, however in audittrail logs it does not show the dashboard name. The query defaults to adhoc and no Splunk system user activity. + Copying or transferring data (data exfiltration), Deleting data and Overwriting data. All risky commands may be found here https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga. + A possible scenario when this might occur is when a malicious actor creates a search that includes commands that exfiltrate or damage data. The malicious actor then sends an unsuspecting user a link to the search. The URL contains a query string (q) and a search identifier (sid), but the sid is not valid. The malicious actor hopes the user will use the link and the search will run. + During analysis, pivot based on user name and filter any user or queries not needed. Queries ran from a dashboard are seen as adhoc queries. When a query runs from a dashboard it will not show in audittrail logs the source dashboard name. The query defaults to adhoc and no Splunk system user activity. In addition, modify this query by removing key commands that generate too much noise, or too little, and create separate queries with higher confidence to alert on.' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type @@ -17,8 +17,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_risky_commands_filter`' -how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. -known_false_positives: False positives will be present until properly filtered by Username, search name, and so forth. +how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. +known_false_positives: False positives will be present until properly filtered by Username and search name. references: - https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning tags: @@ -41,7 +41,7 @@ tags: - Actions on Objectives message: A risky Splunk command has ran by $user$ and should be reviewed. mitre_attack_id: - - T1213 + - T1059 nist: - DE.CM observable: From 3afeaa8a3b14a4eb36e4b59b74437a0a4e3a4d88 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 13 Jun 2022 15:39:43 -0600 Subject: [PATCH 122/148] Update splunk_command_and_scripting_interpreter_delete_usage.yml --- .../splunk_command_and_scripting_interpreter_delete_usage.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml index 62fc569c6c..89545817db 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml @@ -13,7 +13,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_delete_usage_filter`' -how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. Acceleration is recommended. +how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. known_false_positives: False positives may be present if this command is used as a common practice. Filter as needed. references: - https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning From 46cd276adfeaaaf94f1cdd49c936491216e34167 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 13 Jun 2022 15:40:49 -0600 Subject: [PATCH 123/148] Update splunk_identified_ssl_tls_certificates.yml --- .../network/splunk_identified_ssl_tls_certificates.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/detections/network/splunk_identified_ssl_tls_certificates.yml b/detections/network/splunk_identified_ssl_tls_certificates.yml index d20ed006b3..d11510bc9e 100644 --- a/detections/network/splunk_identified_ssl_tls_certificates.yml +++ b/detections/network/splunk_identified_ssl_tls_certificates.yml @@ -4,12 +4,11 @@ version: 1 date: '2022-05-25' author: Michael Haag, Splunk type: Hunting -datamodel: -- Network_Traffic +datamodel: [] description: The following analytic uses tags of SSL, TLS and certificate to identify the usage of the Splunk default certificates being utilized in the environment. Recommended guidance to utilize valid TLS certificates which documentation may be found in Splunk Docs - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL. search: 'tag IN (ssl, tls, certificate) ssl_issuer_common_name=*splunk* | stats values(src) AS "Host(s) with Default Cert" count by ssl_issuer ssl_subject_common_name ssl_subject_organization ssl_subject host sourcetype | `splunk_identified_ssl_tls_certificates_filter`' -how_to_implement: Ingestion of SSL/TLS data is needed and to be tagged properly as ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams. +how_to_implement: Ingestion of SSL/TLS data is needed and to be tagged properly as ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams. known_false_positives: False positives will not be present as it is meant to assist with identifying default certificates being utilized. references: - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL From 66d7814fed158021ab059a1f67a529754ed89639 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 13 Jun 2022 15:43:18 -0600 Subject: [PATCH 124/148] Update splunk_identified_ssl_tls_certificates.yml --- .../network/splunk_identified_ssl_tls_certificates.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/network/splunk_identified_ssl_tls_certificates.yml b/detections/network/splunk_identified_ssl_tls_certificates.yml index d11510bc9e..e02cf855b1 100644 --- a/detections/network/splunk_identified_ssl_tls_certificates.yml +++ b/detections/network/splunk_identified_ssl_tls_certificates.yml @@ -23,12 +23,12 @@ tags: cve: - CVE-2022-32151 - CVE-2022-32152 - confidence: 100 + confidence: 70 context: - Source:Application Log dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1040/ssltls/ssl_splunk.log - impact: 100 + impact: 60 kill_chain_phases: - Reconnaissance message: The following $dest$ is using the self signed Splunk certificate. @@ -52,5 +52,5 @@ tags: - ssl_subject - host - sourcetype - risk_score: 100 + risk_score: 42 security_domain: network From a0967fe429a181d2db2a2acd21fec7cfb0b7fb92 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 13 Jun 2022 16:49:49 -0500 Subject: [PATCH 125/148] Workbook how_to_implement & references --- ...lunk_command_and_scripting_interpreter_risky_commands.yml | 3 ++- .../splunk_digital_certificates_infrastructure_version.yml | 3 ++- .../splunk_digital_certificates_lack_of_encryption.yml | 5 +++-- ..._protocol_impersonation_weak_encryption_configuration.yml | 3 ++- ...unk_protocol_impersonation_weak_encryption_selfsigned.yml | 3 ++- ..._protocol_impersonation_weak_encryption_simplerequest.yml | 3 ++- .../network/splunk_identified_ssl_tls_certificates.yml | 3 ++- 7 files changed, 15 insertions(+), 8 deletions(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml index 02faf6770e..6444d94980 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml @@ -17,10 +17,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_risky_commands_filter`' -how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. +how_to_implement: To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. known_false_positives: False positives will be present until properly filtered by Username and search name. references: - https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning +- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json tags: analytic_story: - Splunk Vulnerabilities diff --git a/detections/application/splunk_digital_certificates_infrastructure_version.yml b/detections/application/splunk_digital_certificates_infrastructure_version.yml index 620e753281..3edd0e1940 100644 --- a/detections/application/splunk_digital_certificates_infrastructure_version.yml +++ b/detections/application/splunk_digital_certificates_infrastructure_version.yml @@ -7,11 +7,12 @@ type: Hunting datamodel: [] description: On June 14th, 2022, Splunk released a security advisory relating to TLS validation occuring between different parts of Splunk Enterprise Infrastructure. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="sslConfig"| table splunk_server sslVerifyServerCert sslVerifyServerName serverCert] | fillnull value="Not Set" | rename sslVerifyServerCert as "Server.conf:SslConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:SslConfig:sslVerifyServerName", serverCert as "Server.conf:SslConfig:serverCert" | `splunk_digital_certificates_infrastructure_version_filter`' -how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers. +how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) in some architectures. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. known_false_positives: No known at this time. references: - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk-to-Splunk_communication - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0602.html +- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json tags: analytic_story: - Splunk Vulnerabilities diff --git a/detections/application/splunk_digital_certificates_lack_of_encryption.yml b/detections/application/splunk_digital_certificates_lack_of_encryption.yml index 10b62666c5..4d9492c2b2 100644 --- a/detections/application/splunk_digital_certificates_lack_of_encryption.yml +++ b/detections/application/splunk_digital_certificates_lack_of_encryption.yml @@ -7,11 +7,12 @@ type: Anomaly datamodel: [] description: On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. The fixes for these require upgrading to at least Splunk 9.0 on the forwarder as well. This is a great opportunity to configure TLS across the environment. This search looks for forwarders that are not using TLS and adds risk to those entities. search: '`splunkd` group="tcpin_connections" ssl="false" | stats values(sourceIp) latest(fwdType) latest(version) by hostname | `splunk_digital_certificates_lack_of_encryption_filter`' -how_to_implement: This anomaly search looks for forwarder connections that are not currently using TLS. It then presents the source IP, the type of forwarder, and the version of the forwarder. You can also remove the "ssl=false" argument from the initial stanza in order to get a full list of all your forwarders that are sending data, and the version of Splunk software they are running, for audit purposes. +how_to_implement: This anomaly search looks for forwarder connections that are not currently using TLS. It then presents the source IP, the type of forwarder, and the version of the forwarder. You can also remove the "ssl=false" argument from the initial stanza in order to get a full list of all your forwarders that are sending data, and the version of Splunk software they are running, for audit purposes. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. known_false_positives: None at this time references: - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html -- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0608.html +- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html +- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json tags: analytic_story: - Splunk Vulnerabilities diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index 1eeca76ac5..7476ab31a4 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -8,10 +8,11 @@ datamodel: [] description: On June 14th, 2022, Splunk released a security advisory relating to TLS validation occuring within the httplib and urllib python libraries shipped with Splunk. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. In addition to these settings, the PYTHONHTTPSVERIFY setting in $SPLUNK_HOME/etc/splunk-launch.conf needs to be enabled as well. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="PythonSslClientConfig" | table splunk_server sslVerifyServerCert sslVerifyServerName] | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-web/settings | table splunk_server serverCert sslVersions] | rename sslVerifyServerCert as "Server.conf:PythonSSLClientConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:PythonSSLClientConfig:sslVerifyServerName", serverCert as "Web.conf:Settings:serverCert", sslVersions as "Web.conf:Settings:sslVersions" | `splunk_protocol_impersonation_weak_encryption_configuration_filter`' how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers. -known_false_positives: While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration. +known_false_positives: While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. references: - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html +- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json tags: analytic_story: - Splunk Vulnerabilities diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml index 97cdca736e..543086a3f4 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -7,11 +7,12 @@ type: Hunting datamodel: [] search: '`splunkd` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | `splunk_protocol_impersonation_weak_encryption_selfsigned_filter`' description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates. -how_to_implement: Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. +how_to_implement: Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. known_false_positives: This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward. references: - https://www.splunk.com/en_us/product-security - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation +- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json tags: analytic_story: - Splunk Vulnerabilities diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index 07c3137ce6..e349aafe6b 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -7,11 +7,12 @@ type: Hunting datamodel: [] search: '`splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | `splunk_protocol_impersonation_weak_encryption_simplerequest_filter`' description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store.This search warns about failure to validate certification using python3 request. -how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. +how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. references: - https://www.splunk.com/en_us/product-security - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation +- https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json tags: analytic_story: - Splunk Vulnerabilities diff --git a/detections/network/splunk_identified_ssl_tls_certificates.yml b/detections/network/splunk_identified_ssl_tls_certificates.yml index e02cf855b1..f5c2e8840e 100644 --- a/detections/network/splunk_identified_ssl_tls_certificates.yml +++ b/detections/network/splunk_identified_ssl_tls_certificates.yml @@ -8,10 +8,11 @@ datamodel: [] description: The following analytic uses tags of SSL, TLS and certificate to identify the usage of the Splunk default certificates being utilized in the environment. Recommended guidance to utilize valid TLS certificates which documentation may be found in Splunk Docs - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL. search: 'tag IN (ssl, tls, certificate) ssl_issuer_common_name=*splunk* | stats values(src) AS "Host(s) with Default Cert" count by ssl_issuer ssl_subject_common_name ssl_subject_organization ssl_subject host sourcetype | `splunk_identified_ssl_tls_certificates_filter`' -how_to_implement: Ingestion of SSL/TLS data is needed and to be tagged properly as ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams. +how_to_implement: Ingestion of SSL/TLS data is needed and to be tagged properly as ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. known_false_positives: False positives will not be present as it is meant to assist with identifying default certificates being utilized. references: - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL + - https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json tags: analytic_story: - Splunk Vulnerabilities From be1c572724a04b483b77a18725c2d048eb633c6c Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 13 Jun 2022 16:50:50 -0500 Subject: [PATCH 126/148] Fixed field --- ...k_protocol_impersonation_weak_encryption_configuration.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml index 7476ab31a4..cd0df357c2 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml @@ -7,8 +7,8 @@ type: Hunting datamodel: [] description: On June 14th, 2022, Splunk released a security advisory relating to TLS validation occuring within the httplib and urllib python libraries shipped with Splunk. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. In addition to these settings, the PYTHONHTTPSVERIFY setting in $SPLUNK_HOME/etc/splunk-launch.conf needs to be enabled as well. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="PythonSslClientConfig" | table splunk_server sslVerifyServerCert sslVerifyServerName] | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-web/settings | table splunk_server serverCert sslVersions] | rename sslVerifyServerCert as "Server.conf:PythonSSLClientConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:PythonSSLClientConfig:sslVerifyServerName", serverCert as "Web.conf:Settings:serverCert", sslVersions as "Web.conf:Settings:sslVersions" | `splunk_protocol_impersonation_weak_encryption_configuration_filter`' -how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers. -known_false_positives: While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (The `dispatch_rest_to_indexers` capability). Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +known_false_positives: While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration. references: - https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation - https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html From 9a266a78ee7483e65ad652e618bb84b74c75dd36 Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Mon, 13 Jun 2022 15:33:12 -0700 Subject: [PATCH 127/148] update per review comments --- ...ng_interpreter_risky_spl_mltk_baseline.yml | 84 +++++++++++++++++++ ...ky_command_abuse_ml_detection_baseline.yml | 71 ---------------- ..._scripting_interpreter_risky_spl_mltk.yml} | 33 +++++--- ...pting_interpreter_risky_spl_mltk.test.yml} | 10 +-- 4 files changed, 109 insertions(+), 89 deletions(-) create mode 100644 baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml delete mode 100644 baselines/splunk_risky_command_abuse_ml_detection_baseline.yml rename detections/application/{splunk_risky_command_abuse_ml_detection.yml => splunk_command_and_scripting_interpreter_risky_spl_mltk.yml} (55%) rename tests/application/{splunk_risky_command_abuse_ml_detection.test.yml => splunk_command_and_scripting_interpreter_risky_spl_mltk.test.yml} (56%) diff --git a/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml new file mode 100644 index 0000000000..c1c27acae4 --- /dev/null +++ b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml @@ -0,0 +1,84 @@ +name: Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline +id: 273df2f7-643a-451a-8d4d-637e39eadc87 +version: 1 +date: '2022-05-27' +author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk +type: Baseline +datamodel: +- Splunk_Audit +description: 'This search is to build a per user command and scripting risky SPL detection model using MLTK + DensityFunction algorithm based on audit log data of Splunk apps. The model is built from past 7 days users + history of running search commands from + https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga, + and aggregate the total search run time for each hour as indicator of user behavior. The default threshold of + outlier boundary is defined as 0.1%, which means that the possibility of search run time exceeding that + boundary is smaller than 0.1%. This search should be scheduled to run at least as frequently as every 7 days. + The name of ML model generated is "risky_command_abuse" and should be configured to be globally shared (not + private) in MLTK app as ducumented here: + https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Models#Sharing_models_from_other_Splunk_apps + unless the same account of training this model will be used to perfeorm inference using this model for anomaly + detection. ' +search: '| tstats values(Search_Activity.user) as user, sum(Search_Activity.total_run_time) as run_time count + FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") + AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now) + AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", + "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) + AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) + BY _time, Search_Activity.user span=1h + | fit DensityFunction "run_time" dist=auto threshold=0.001 show_density=true by "user" into "risky_command_abuse" ' +how_to_implement: The corresponding detection of using this model is "Splunk Command and Scripting Interpreter Risky + SPL MLTK". This detection depends on MLTK app which can be hound here - https://splunkbase.splunk.com/app/2890/ + and it assumes Splunk accelerated audit data model is available. For large enterprises, training the model might + take significant computing resources. It might requires dedicated search head. The underlined machine learning + algorithm this detection used is DensityFunction. It might need to incresase its settings default values, such as + max_fit_time, max_groups, etc. More details of achieving optmal performance abd configuring DensityFunction + parameters can be found here - https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Configurefitandapply + Users can modify earliest=-7d@d in the search to other value so that the search can collect enough data points + to build a good bseline model. Users can also modify list of risky commands in "Search_Activity.search IN" to better + suit users' violation policy and their usage environment. +known_false_positives: If the run time of a search exceeds the boundaries of outlier defined by the fitted density + function model, false positives can occur, incorrectly labeling a long running search as potentially risky. +references: +- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning +tags: + analytic_story: + - Splunk Vulnerabilities + asset_type: Web Server + cis20: + - CIS 3 + - CIS 6 + confidence: 40 + cve: + - CVE-2022-32154 + context: + - Source:Endpoint + dataset: + - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt + impact: 50 + kill_chain_phases: + - Actions on Objectives + message: ML model "risky_command_abuse" training is completed. + mitre_attack_id: + - T1059 + nist: + - DE.AE + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Search_Activity.search + - Search_Activity.total_run_time + - Search_Activity.user + - Search_Activity.search_type + risk_score: 20 + security_domain: audit + detections: + - Splunk Command and Scripting Interpreter Risky SPL MLTK + diff --git a/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml b/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml deleted file mode 100644 index 4175681ff2..0000000000 --- a/baselines/splunk_risky_command_abuse_ml_detection_baseline.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Splunk Risky Command Abuse ML Detection Baseline -id: 273df2f7-643a-451a-8d4d-637e39eadc87 -version: 1 -date: '2022-05-27' -author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk -type: Baseline -datamodel: -- Splunk_Audit -description: 'This search is to build a per user risky command abuse detection model using MLTK DensityFunction - algorithm based on audit log data of Splunk apps. The model is built from past 7 days users history of running - search commands containing risky keywords, and aggregate the total search run time for each hour as indicator of - user behavior. The default threshold of outlier boundary is defined as 0.1%. This search should be scheduled to - run at least as frequently as every 7 days to build a recent baseline for each user. The name of ML model - generated is "risky_command_abuse" and should be configured as global (not private) in MLTK app, unless the same - account of training this model will be used to perfeorm inference using this model for anomaly detection. - The corresponding detection of using this model is "Splunk Risky Command Abuse ML Detection". ' -search: '| tstats values(Search_Activity.user) as user, sum(Search_Activity.total_run_time) as run_time count - FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") - AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now) - AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", - "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) - AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) - BY _time, Search_Activity.user span=1h - | fit DensityFunction "run_time" dist=auto threshold=0.001 show_density=true by "user" into "risky_command_abuse" ' -how_to_implement: This detection depends on MLTK and assumes Splunk audit data model is available. - For large enterprises, training the model might take significant computing resources, and might - need to incresase MLTK DensityFunction settings default values, such as max_fit_time, max_groups, etc. -known_false_positives: Benigh search of long run time will be flagged as positive (false), if the run time of - a search exceeds the boundaries of outlier defined by the fitted density function model. -references: -- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning -tags: - analytic_story: - - Splunk Vulnerabilities - asset_type: Web Server - cis20: - - CIS 3 - - CIS 6 - confidence: 40 - context: - - Source:Endpoint - dataset: - - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt - impact: 50 - kill_chain_phases: - - Actions on Objectives - message: ML model "risky_command_abuse" training is completed. - mitre_attack_id: - - T1203 - nist: - - DE.AE - observable: - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - Search_Activity.search - - Search_Activity.total_run_time - - Search_Activity.user - - Search_Activity.search_type - risk_score: 20 - security_domain: audit - detections: - - Splunk Risky Command Abuse ML Detection - diff --git a/detections/application/splunk_risky_command_abuse_ml_detection.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml similarity index 55% rename from detections/application/splunk_risky_command_abuse_ml_detection.yml rename to detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml index 709d3b7182..632f466415 100644 --- a/detections/application/splunk_risky_command_abuse_ml_detection.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml @@ -1,4 +1,4 @@ -name: Splunk Risky Command Abuse ML Detection +name: Splunk Command and Scripting Interpreter Risky SPL MLTK id: 19d0146c-2eae-4e53-8d39-1198a78fa9ca version: 1 date: '2022-05-27' @@ -6,14 +6,16 @@ author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk type: Anomaly datamodel: - Splunk_Audit -description: 'This detection utilize machine learning model named "risky_command_abuse" trained from "Splunk - Risky Command Abuse ML Model Baseline". It should be scheduled to run every hour - to detect whether a user has run searches containing risky keywords with abnormal long running time in the - past two hours, comparing with his/her past seven days history. ' +description: 'This detection utilize machine learning model named "risky_command_abuse" trained from "Splunk Command + and Scripting Interpreter Risky SPL MLTK Baseline". It should be scheduled to run hourly to detect whether a user + has run searches containing risky SPL from this list + https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga + with abnormal long running time in the past one hour, comparing with his/her past seven days history. This search + uses the trained baseline to infer whether a search is an outlier (isOutlier ~= 1.0) or not (isOutlier_= 0.0)' search: '| tstats values(Search_Activity.user) AS user, sum(Search_Activity.total_run_time) AS run_time, values(Search_Activity.search) as searches, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") - AND (Search_Activity.total_run_time>1) AND (earliest=-2h@h latest=now) + AND (Search_Activity.total_run_time>1) AND (earliest=-1h@h latest=now) AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) @@ -21,10 +23,13 @@ search: '| tstats values(Search_Activity.user) AS user, sum(Search_Activity.tota | apply risky_command_abuse | fields _time, user, searches, run_time, IsOutlier(run_time) | rename IsOutlier(run_time) as isOutlier, _time as timestamp - | where isOutlier>0.5 | `splunk_risky_command_abuse_ml_detection_filter`' -how_to_implement: This detection depends on MLTK and assumes Splunk audit data model is available. -known_false_positives: Benigh search of long run time will be flagged as positive (false), if the run time of - a search exceeds the boundaries of outlier defined by the fitted density function model. + | where isOutlier>0.5 + | `splunk_command_and_scripting_interpreter_risky_spl_mltk_filter`' +how_to_implement: This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ + and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Baseline model + needs to be buillt using "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline" before this search can run. +known_false_positives: If the run time of a search exceeds the boundaries of outlier defined by the fitted density + function model, false positives can occur, incorrectly labeling a long running search as potentially risky. references: - https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning tags: @@ -35,6 +40,8 @@ tags: - CIS 3 - CIS 6 confidence: 40 + cve: + - CVE-2022-32154 context: - Source:Endpoint dataset: @@ -42,9 +49,9 @@ tags: impact: 50 kill_chain_phases: - Actions on Objectives - message: $user used abnormally long run time for searches with risky command. + message: Abnormally long run time for risk SPL command seen by user $user. mitre_attack_id: - - T1203 + - T1059 nist: - DE.AE observable: @@ -64,4 +71,4 @@ tags: - Search_Activity.search_type risk_score: 20 security_domain: audit - \ No newline at end of file + diff --git a/tests/application/splunk_risky_command_abuse_ml_detection.test.yml b/tests/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.test.yml similarity index 56% rename from tests/application/splunk_risky_command_abuse_ml_detection.test.yml rename to tests/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.test.yml index c937b44717..00c80c42b7 100644 --- a/tests/application/splunk_risky_command_abuse_ml_detection.test.yml +++ b/tests/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.test.yml @@ -1,13 +1,13 @@ -name: Splunk Risky Command Abuse ML Detection Unit Test +name: Splunk Command and Scripting Interpreter Risky SPL MLTK Unit Test tests: -- name: Splunk Risky Command Abuse ML Detection - file: application/splunk_risky_command_abuse_ml_detection.yml +- name: Splunk Command and Scripting Interpreter Risky SPL MLTK + file: splunk_command_and_scripting_interpreter_risky_spl_mltk.yml pass_condition: '| stats count | where count > 0' earliest_time: -1h latest_time: now baselines: - - name: Splunk Risky Command Abuse ML Detection Baseline - file: baselines/splunk_risky_command_abuse_ml_detection_baseline.yml + - name: Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline + file: baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml pass_condition: '| stats count | where count > 0' earliest_time: -7d latest_time: now From 99cbc03fd5b503fbb22019a2d68143508b5989ed Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Mon, 13 Jun 2022 15:47:06 -0700 Subject: [PATCH 128/148] fixedhosts --- ...splunk_protocol_impersonation_weak_encryption_selfsigned.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml index 543086a3f4..9fed47ed14 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml @@ -31,7 +31,7 @@ tags: impact: 50 kill_chain_phases: - Exploitation - message: Splunk default issued certificate at host$ + message: Splunk default issued certificate at $host$ mitre_attack_id: - T1588.004 nist: From 7b2dc90afb16e614137d4a8b7b7adaa68852c0ad Mon Sep 17 00:00:00 2001 From: Rod Soto <50486899+rosplk@users.noreply.github.com> Date: Mon, 13 Jun 2022 15:51:53 -0700 Subject: [PATCH 129/148] fixedsearchdescription --- ...unk_protocol_impersonation_weak_encryption_simplerequest.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index e349aafe6b..2e29e2cbeb 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -6,7 +6,7 @@ author: Rod Soto, Splunk type: Hunting datamodel: [] search: '`splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | `splunk_protocol_impersonation_weak_encryption_simplerequest_filter`' -description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store.This search warns about failure to validate certification using python3 request. +description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store. This search warns a user about a failure to validate a certificate using python3 request. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. references: From 000e75040d6866d4f4b414e14a9d60b06ab6b116 Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Mon, 13 Jun 2022 16:39:09 -0700 Subject: [PATCH 130/148] fix typos --- ...d_scripting_interpreter_risky_spl_mltk_baseline.yml | 10 +++++----- ...ommand_and_scripting_interpreter_risky_spl_mltk.yml | 6 +++--- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml index c1c27acae4..73b8c90c1f 100644 --- a/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml +++ b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml @@ -12,9 +12,9 @@ description: 'This search is to build a per user command and scripting risky SPL https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga, and aggregate the total search run time for each hour as indicator of user behavior. The default threshold of outlier boundary is defined as 0.1%, which means that the possibility of search run time exceeding that - boundary is smaller than 0.1%. This search should be scheduled to run at least as frequently as every 7 days. - The name of ML model generated is "risky_command_abuse" and should be configured to be globally shared (not - private) in MLTK app as ducumented here: + boundary is smaller than 0.1%, indicating a risky use of these commands. This search should be scheduled to run + at least as frequently as every 7 days. The name of machine learning model generated is "risky_command_abuse" + and should be configured to be globally shared (not private) in MLTK app as ducumented here: https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Models#Sharing_models_from_other_Splunk_apps unless the same account of training this model will be used to perfeorm inference using this model for anomaly detection. ' @@ -31,10 +31,10 @@ how_to_implement: The corresponding detection of using this model is "Splunk Com and it assumes Splunk accelerated audit data model is available. For large enterprises, training the model might take significant computing resources. It might requires dedicated search head. The underlined machine learning algorithm this detection used is DensityFunction. It might need to incresase its settings default values, such as - max_fit_time, max_groups, etc. More details of achieving optmal performance abd configuring DensityFunction + max_fit_time, max_groups, etc. More details of achieving optimal performance and configuring DensityFunction parameters can be found here - https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Configurefitandapply Users can modify earliest=-7d@d in the search to other value so that the search can collect enough data points - to build a good bseline model. Users can also modify list of risky commands in "Search_Activity.search IN" to better + to build a good baseline model. Users can also modify list of risky commands in "Search_Activity.search IN" to better suit users' violation policy and their usage environment. known_false_positives: If the run time of a search exceeds the boundaries of outlier defined by the fitted density function model, false positives can occur, incorrectly labeling a long running search as potentially risky. diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml index 632f466415..d3c5e5b32f 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml @@ -6,12 +6,12 @@ author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk type: Anomaly datamodel: - Splunk_Audit -description: 'This detection utilize machine learning model named "risky_command_abuse" trained from "Splunk Command +description: 'This detection utilizes machine learning model named "risky_command_abuse" trained from "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline". It should be scheduled to run hourly to detect whether a user has run searches containing risky SPL from this list https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga - with abnormal long running time in the past one hour, comparing with his/her past seven days history. This search - uses the trained baseline to infer whether a search is an outlier (isOutlier ~= 1.0) or not (isOutlier_= 0.0)' + with abnormally long running time in the past one hour, comparing with his/her past seven days history. This search + uses the trained baseline to infer whether a search is an outlier (isOutlier ~= 1.0) or not (isOutlier~= 0.0)' search: '| tstats values(Search_Activity.user) AS user, sum(Search_Activity.total_run_time) AS run_time, values(Search_Activity.search) as searches, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") From a247079b45b8fb2d07ce7095f7c5c6c54466bb2f Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Mon, 13 Jun 2022 17:15:45 -0700 Subject: [PATCH 131/148] update and typos --- ...ipting_interpreter_risky_spl_mltk_baseline.yml | 15 ++++++++------- ...d_and_scripting_interpreter_risky_spl_mltk.yml | 2 +- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml index 73b8c90c1f..bda1136ce5 100644 --- a/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml +++ b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml @@ -12,11 +12,12 @@ description: 'This search is to build a per user command and scripting risky SPL https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga, and aggregate the total search run time for each hour as indicator of user behavior. The default threshold of outlier boundary is defined as 0.1%, which means that the possibility of search run time exceeding that - boundary is smaller than 0.1%, indicating a risky use of these commands. This search should be scheduled to run - at least as frequently as every 7 days. The name of machine learning model generated is "risky_command_abuse" - and should be configured to be globally shared (not private) in MLTK app as ducumented here: + boundary is smaller than 0.1% (three 9s - 0.999), indicating a risky use of these commands. Users can adjust + this threshold 0.1% to higher or lower value depending on desired false positive report rate. This search should + be scheduled to run at least as frequently as every 7 days. The name of machine learning model generated is + "risky_command_abuse" and should be configured to be globally shared (not private) in MLTK app as documented here: https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Models#Sharing_models_from_other_Splunk_apps - unless the same account of training this model will be used to perfeorm inference using this model for anomaly + unless the same account of training this model will be used to perform inference using this model for anomaly detection. ' search: '| tstats values(Search_Activity.user) as user, sum(Search_Activity.total_run_time) as run_time count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") @@ -29,8 +30,8 @@ search: '| tstats values(Search_Activity.user) as user, sum(Search_Activity.tota how_to_implement: The corresponding detection of using this model is "Splunk Command and Scripting Interpreter Risky SPL MLTK". This detection depends on MLTK app which can be hound here - https://splunkbase.splunk.com/app/2890/ and it assumes Splunk accelerated audit data model is available. For large enterprises, training the model might - take significant computing resources. It might requires dedicated search head. The underlined machine learning - algorithm this detection used is DensityFunction. It might need to incresase its settings default values, such as + take significant computing resources. It might require dedicated search head. The underlined machine learning + algorithm this detection used is DensityFunction. It might need to increase its settings default values, such as max_fit_time, max_groups, etc. More details of achieving optimal performance and configuring DensityFunction parameters can be found here - https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Configurefitandapply Users can modify earliest=-7d@d in the search to other value so that the search can collect enough data points @@ -51,7 +52,7 @@ tags: cve: - CVE-2022-32154 context: - - Source:Endpoint + - Source: Endpoint dataset: - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt impact: 50 diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml index d3c5e5b32f..66251ae54c 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml @@ -27,7 +27,7 @@ search: '| tstats values(Search_Activity.user) AS user, sum(Search_Activity.tota | `splunk_command_and_scripting_interpreter_risky_spl_mltk_filter`' how_to_implement: This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Baseline model - needs to be buillt using "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline" before this search can run. + needs to be built using "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline" before this search can run. known_false_positives: If the run time of a search exceeds the boundaries of outlier defined by the fitted density function model, false positives can occur, incorrectly labeling a long running search as potentially risky. references: From c701be5699cc8efe880c884e6e382c4f42275f7c Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Tue, 14 Jun 2022 00:30:38 -0700 Subject: [PATCH 132/148] for review comment --- ...ng_interpreter_risky_spl_mltk_baseline.yml | 24 ++++++++++--------- ...d_scripting_interpreter_risky_spl_mltk.yml | 7 +++--- 2 files changed, 17 insertions(+), 14 deletions(-) diff --git a/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml index bda1136ce5..9ebafeb336 100644 --- a/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml +++ b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml @@ -6,29 +6,31 @@ author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk type: Baseline datamodel: - Splunk_Audit -description: 'This search is to build a per user command and scripting risky SPL detection model using MLTK - DensityFunction algorithm based on audit log data of Splunk apps. The model is built from past 7 days users - history of running search commands from +description: 'This search supports an analyst looking for abuse or misuse of the risky commands listed here: https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga, - and aggregate the total search run time for each hour as indicator of user behavior. The default threshold of - outlier boundary is defined as 0.1%, which means that the possibility of search run time exceeding that - boundary is smaller than 0.1% (three 9s - 0.999), indicating a risky use of these commands. Users can adjust - this threshold 0.1% to higher or lower value depending on desired false positive report rate. This search should - be scheduled to run at least as frequently as every 7 days. The name of machine learning model generated is + This is accomplished by using the time spent executing one of these risky commands as a proxy for misuse/abuse + of interest during investigation and/or hunting. + The search builds a model utilizes the MLTK DensityFunction algorithm on Splunk app audit log data. The model + uses the past 7 days of user history executing the above referenced commands then aggregates the total search + run time for each hour as indicator of user behavior. + The model identifies the top 0.1% of user search run time, indicating a risky use of these commands. Users can + adjust this threshold 0.1% as interested however this will correlate to missed/false positive rates. This search + should be scheduled to run at least every 7 days. The name of machine learning model generated is "risky_command_abuse" and should be configured to be globally shared (not private) in MLTK app as documented here: https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Models#Sharing_models_from_other_Splunk_apps unless the same account of training this model will be used to perform inference using this model for anomaly detection. ' -search: '| tstats values(Search_Activity.user) as user, sum(Search_Activity.total_run_time) as run_time count +search: '| tstats sum(Search_Activity.total_run_time) as run_time, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now) AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) BY _time, Search_Activity.user span=1h - | fit DensityFunction "run_time" dist=auto threshold=0.001 show_density=true by "user" into "risky_command_abuse" ' + | fit DensityFunction "run_time" dist=auto lower_threshold=0.000001 upper_threshold=0.001 show_density=true + by Search_Activity.user into "risky_command_abuse" ' how_to_implement: The corresponding detection of using this model is "Splunk Command and Scripting Interpreter Risky - SPL MLTK". This detection depends on MLTK app which can be hound here - https://splunkbase.splunk.com/app/2890/ + SPL MLTK". This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and it assumes Splunk accelerated audit data model is available. For large enterprises, training the model might take significant computing resources. It might require dedicated search head. The underlined machine learning algorithm this detection used is DensityFunction. It might need to increase its settings default values, such as diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml index 66251ae54c..e428e9ca9e 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml @@ -12,7 +12,7 @@ description: 'This detection utilizes machine learning model named "risky_comman https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga with abnormally long running time in the past one hour, comparing with his/her past seven days history. This search uses the trained baseline to infer whether a search is an outlier (isOutlier ~= 1.0) or not (isOutlier~= 0.0)' -search: '| tstats values(Search_Activity.user) AS user, sum(Search_Activity.total_run_time) AS run_time, +search: '| tstats sum(Search_Activity.total_run_time) AS run_time, values(Search_Activity.search) as searches, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") AND (Search_Activity.total_run_time>1) AND (earliest=-1h@h latest=now) @@ -21,13 +21,14 @@ search: '| tstats values(Search_Activity.user) AS user, sum(Search_Activity.tota AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) BY _time, Search_Activity.user span=1h | apply risky_command_abuse - | fields _time, user, searches, run_time, IsOutlier(run_time) + | fields _time, Search_Activity.user, searches, run_time, IsOutlier(run_time) | rename IsOutlier(run_time) as isOutlier, _time as timestamp | where isOutlier>0.5 | `splunk_command_and_scripting_interpreter_risky_spl_mltk_filter`' how_to_implement: This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Baseline model needs to be built using "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline" before this search can run. + Please note that the current search only finds matches exactly one space between separator bar and risky commands. known_false_positives: If the run time of a search exceeds the boundaries of outlier defined by the fitted density function model, false positives can occur, incorrectly labeling a long running search as potentially risky. references: @@ -49,7 +50,7 @@ tags: impact: 50 kill_chain_phases: - Actions on Objectives - message: Abnormally long run time for risk SPL command seen by user $user. + message: Abnormally long run time for risk SPL command seen by user $(Search_Activity.user). mitre_attack_id: - T1059 nist: From d91d88ecb7f5a5fcd1b959c1178d469a401b1583 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Tue, 14 Jun 2022 07:58:41 -0400 Subject: [PATCH 133/148] updated base on karims comments --- ...ng_interpreter_risky_spl_mltk_baseline.yml | 21 +++++++------------ 1 file changed, 7 insertions(+), 14 deletions(-) diff --git a/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml index 9ebafeb336..4dfd0d8702 100644 --- a/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml +++ b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml @@ -6,20 +6,13 @@ author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk type: Baseline datamodel: - Splunk_Audit -description: 'This search supports an analyst looking for abuse or misuse of the risky commands listed here: - https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga, - This is accomplished by using the time spent executing one of these risky commands as a proxy for misuse/abuse - of interest during investigation and/or hunting. - The search builds a model utilizes the MLTK DensityFunction algorithm on Splunk app audit log data. The model - uses the past 7 days of user history executing the above referenced commands then aggregates the total search - run time for each hour as indicator of user behavior. - The model identifies the top 0.1% of user search run time, indicating a risky use of these commands. Users can - adjust this threshold 0.1% as interested however this will correlate to missed/false positive rates. This search - should be scheduled to run at least every 7 days. The name of machine learning model generated is - "risky_command_abuse" and should be configured to be globally shared (not private) in MLTK app as documented here: - https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Models#Sharing_models_from_other_Splunk_apps - unless the same account of training this model will be used to perform inference using this model for anomaly - detection. ' +description: 'This search supports an analyst looking for abuse or misuse of the risky commands listed here: https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning +This is accomplished by using the time spent executing one of these risky commands as a proxy for misuse/abuse of interest during investigation and/or hunting. +The search builds a model utilizes the MLTK DensityFunction algorithm on Splunk app audit log data. The model uses the past 7 days of user history executing the above referenced commands then aggregates the total search run time for each hour as indicator of user behavior. +The model identifies the top 0.1% of user search run time, indicating a risky use of these commands. Users can adjust this threshold 0.1% as interested however this will correlate to missed/false positive rates. This search should be scheduled to run at least every 7 days. The name of machine learning model generated is "risky_command_abuse" and should be configured to be globally shared (not private) in MLTK app as documented here: +https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Models#Sharing_models_from_other_Splunk_apps +unless the same account of training this model will be used to perform inference using this model for anomaly +detection.' search: '| tstats sum(Search_Activity.total_run_time) as run_time, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now) From 786b26d85890cf5352503ed41c861fd4372106e1 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Tue, 14 Jun 2022 08:04:57 -0400 Subject: [PATCH 134/148] fixing base on feedback from david --- .../splunk_command_and_scripting_interpreter_delete_usage.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml index 89545817db..6969eb15da 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml @@ -9,7 +9,7 @@ datamodel: description: The following analytic identifies the use of the risky command - Delete - that may be utilized in Splunk to delete some or all data queried for. In order to use Delete in Splunk, one must be assigned the role. This is typically not used and should generate an anomaly if it is used. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| delete*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type - | `drop_dm_object_name(Splunk_Audit)` + | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_delete_usage_filter`' From cbbe43658513aff764d3d07e95d554773434d7b6 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Tue, 14 Jun 2022 08:07:14 -0400 Subject: [PATCH 135/148] updated given davids suggestions --- .../splunk_command_and_scripting_interpreter_delete_usage.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml index 6969eb15da..234673ce69 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml @@ -27,7 +27,7 @@ tags: - CIS 16 cve: - CVE-2022-32154 - confidence: 80 + confidence: 30 context: - Source:Endpoint dataset: @@ -57,6 +57,6 @@ tags: - Search_Activity.user - Search_Activity.savedsearch_name - Search_Activity.search_type - risk_score: 72 + risk_score: 27 security_domain: audit From 9e28d378cc7feb7c22d0cd64c0d93e358d484076 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Tue, 14 Jun 2022 08:09:20 -0400 Subject: [PATCH 136/148] updated from karims suggestion --- .../splunk_command_and_scripting_interpreter_delete_usage.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml index 234673ce69..f6a130199f 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml @@ -35,7 +35,7 @@ tags: impact: 90 kill_chain_phases: - Actions on Objectives - message: Delete command has ran by $user$ and should be reviewed. + message: $user$ executed the 'delete' command, if this is unexpected it should be reviewed. mitre_attack_id: - T1059 nist: From b8d7a20e7391d4927b4ce3544d695b4cf9a8caa2 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Tue, 14 Jun 2022 08:10:11 -0400 Subject: [PATCH 137/148] fixing dm to drop from davids suggestion --- .../splunk_command_and_scripting_interpreter_risky_commands.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml index 6444d94980..4511f8532c 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml @@ -13,7 +13,7 @@ description: 'The Splunk platform contains built-in search processing language ( In addition, modify this query by removing key commands that generate too much noise, or too little, and create separate queries with higher confidence to alert on.' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type - | `drop_dm_object_name(Splunk_Audit)` + | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_risky_commands_filter`' From 4b95ac0339aec7bcdcbbba0e8c0a5bf99e129edc Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Tue, 14 Jun 2022 08:15:36 -0400 Subject: [PATCH 138/148] Update splunk_digital_certificates_infrastructure_version.yml --- .../splunk_digital_certificates_infrastructure_version.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_digital_certificates_infrastructure_version.yml b/detections/application/splunk_digital_certificates_infrastructure_version.yml index 3edd0e1940..01779041cc 100644 --- a/detections/application/splunk_digital_certificates_infrastructure_version.yml +++ b/detections/application/splunk_digital_certificates_infrastructure_version.yml @@ -5,7 +5,7 @@ date: '2022-05-26' author: Lou Stella, Splunk type: Hunting datamodel: [] -description: On June 14th, 2022, Splunk released a security advisory relating to TLS validation occuring between different parts of Splunk Enterprise Infrastructure. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. +description: This search will check the TLS validation is properly configured on the search head it is run from as well as its search peers after Splunk version 9. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. search: '| rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="sslConfig"| table splunk_server sslVerifyServerCert sslVerifyServerName serverCert] | fillnull value="Not Set" | rename sslVerifyServerCert as "Server.conf:SslConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:SslConfig:sslVerifyServerName", serverCert as "Server.conf:SslConfig:serverCert" | `splunk_digital_certificates_infrastructure_version_filter`' how_to_implement: The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) in some architectures. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. known_false_positives: No known at this time. From 937a7317cfd80537295d1fce2c433b992f52b562 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Tue, 14 Jun 2022 08:17:25 -0400 Subject: [PATCH 139/148] Update splunk_protocol_impersonation_weak_encryption_simplerequest.yml --- ...unk_protocol_impersonation_weak_encryption_simplerequest.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index 2e29e2cbeb..6ff1261c1d 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -6,7 +6,7 @@ author: Rod Soto, Splunk type: Hunting datamodel: [] search: '`splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | `splunk_protocol_impersonation_weak_encryption_simplerequest_filter`' -description: On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. From version 9 on Python3 client libraries now verify server certificates by default and use CA certificate store. This search warns a user about a failure to validate a certificate using python3 request. +description: On Splunk version 9 on Python3 client libraries verify server certificates by default and use CA certificate store. This search warns a user about a failure to validate a certificate using python3 request. how_to_implement: Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. known_false_positives: This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. references: From 35135877076e7528ad5159e4ff7bc56d76ba47a0 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Tue, 14 Jun 2022 08:17:53 -0400 Subject: [PATCH 140/148] Update splunk_protocol_impersonation_weak_encryption_simplerequest.yml --- ...unk_protocol_impersonation_weak_encryption_simplerequest.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml index 6ff1261c1d..6b015586eb 100644 --- a/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml +++ b/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml @@ -31,7 +31,7 @@ tags: impact: 50 kill_chain_phases: - Exploitation - message: Failed to validate certificate on host$ + message: Failed to validate certificate on $host$ mitre_attack_id: - T1588.004 nist: From 0288c10f70b931d7935233fcd6a9d9cdf6a8c5ea Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Tue, 14 Jun 2022 08:18:53 -0400 Subject: [PATCH 141/148] Update splunk_identified_ssl_tls_certificates.yml --- detections/network/splunk_identified_ssl_tls_certificates.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/network/splunk_identified_ssl_tls_certificates.yml b/detections/network/splunk_identified_ssl_tls_certificates.yml index f5c2e8840e..2ad0783d72 100644 --- a/detections/network/splunk_identified_ssl_tls_certificates.yml +++ b/detections/network/splunk_identified_ssl_tls_certificates.yml @@ -5,7 +5,7 @@ date: '2022-05-25' author: Michael Haag, Splunk type: Hunting datamodel: [] -description: The following analytic uses tags of SSL, TLS and certificate to identify the usage of the Splunk default certificates being utilized in the environment. Recommended guidance to utilize valid TLS certificates which documentation may be found in Splunk Docs - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL. +description: The following analytic uses tags of SSL, TLS and certificate to identify the usage of the Splunk default certificates being utilized in the environment. Recommended guidance is to utilize valid TLS certificates which documentation may be found in Splunk Docs - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL. search: 'tag IN (ssl, tls, certificate) ssl_issuer_common_name=*splunk* | stats values(src) AS "Host(s) with Default Cert" count by ssl_issuer ssl_subject_common_name ssl_subject_organization ssl_subject host sourcetype | `splunk_identified_ssl_tls_certificates_filter`' how_to_implement: Ingestion of SSL/TLS data is needed and to be tagged properly as ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. From 9c3eb1640a677256045a946fb61ebeaaf1f51b9b Mon Sep 17 00:00:00 2001 From: d1vious Date: Tue, 14 Jun 2022 09:17:24 -0400 Subject: [PATCH 142/148] fixing tscollect error --- ...ommand_and_scripting_interpreter_risky_spl_mltk_baseline.yml | 2 +- .../splunk_command_and_scripting_interpreter_risky_commands.yml | 2 +- .../splunk_command_and_scripting_interpreter_risky_spl_mltk.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml index 4dfd0d8702..b9275b04d1 100644 --- a/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml +++ b/baselines/splunk_command_and_scripting_interpreter_risky_spl_mltk_baseline.yml @@ -17,7 +17,7 @@ search: '| tstats sum(Search_Activity.total_run_time) as run_time, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now) AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", - "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) + "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*")) AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) BY _time, Search_Activity.user span=1h | fit DensityFunction "run_time" dist=auto lower_threshold=0.000001 upper_threshold=0.001 show_density=true diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml index 4511f8532c..b1cadad85b 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml @@ -11,7 +11,7 @@ description: 'The Splunk platform contains built-in search processing language ( A possible scenario when this might occur is when a malicious actor creates a search that includes commands that exfiltrate or damage data. The malicious actor then sends an unsuspecting user a link to the search. The URL contains a query string (q) and a search identifier (sid), but the sid is not valid. The malicious actor hopes the user will use the link and the search will run. During analysis, pivot based on user name and filter any user or queries not needed. Queries ran from a dashboard are seen as adhoc queries. When a query runs from a dashboard it will not show in audittrail logs the source dashboard name. The query defaults to adhoc and no Splunk system user activity. In addition, modify this query by removing key commands that generate too much noise, or too little, and create separate queries with higher confidence to alert on.' -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` diff --git a/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml b/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml index e428e9ca9e..516c9f4af1 100644 --- a/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml +++ b/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml @@ -17,7 +17,7 @@ search: '| tstats sum(Search_Activity.total_run_time) AS run_time, FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") AND (Search_Activity.total_run_time>1) AND (earliest=-1h@h latest=now) AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", - "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) + "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*")) AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) BY _time, Search_Activity.user span=1h | apply risky_command_abuse From 22de947482dd56fd765a0f8e4619bfe8c4ff4c94 Mon Sep 17 00:00:00 2001 From: research bot Date: Tue, 14 Jun 2022 14:10:53 +0000 Subject: [PATCH 143/148] updating docs and package bits [ci skip] --- dist/escu/app.manifest | 2 +- dist/escu/default/analyticstories.conf | 104 +++- dist/escu/default/app.conf | 4 +- dist/escu/default/collections.conf | 2 +- dist/escu/default/content-version.conf | 2 +- dist/escu/default/es_investigations.conf | 2 +- dist/escu/default/macros.conf | 48 +- dist/escu/default/savedsearches.conf | 450 +++++++++++++++++- dist/escu/default/transforms.conf | 2 +- dist/escu/default/workflow_actions.conf | 2 +- docs/_data/navigation.yml | 2 + docs/_pages/detections.md | 10 + docs/_pages/splunk_audit.md | 9 + docs/_pages/stories.md | 2 +- ...od_without_successful_netbackup_backups.md | 2 +- ...17-09-12-unsuccessful_netbackup_backups.md | 2 +- .../2017-09-23-monitor_dns_for_brand_abuse.md | 2 +- ...-23-monitor_web_traffic_for_brand_abuse.md | 2 +- ...detect_spike_in_security_group_activity.md | 2 +- ...18-06-28-detect_s3_access_from_a_new_ip.md | 2 +- ...-10-23-wmi_permanent_event_subscription.md | 2 +- ...-10-23-wmi_temporary_event_subscription.md | 2 +- .../2018-12-03-remote_wmi_command_attempt.md | 2 +- ...ikatz_via_powershell_and_eventcode_4703.md | 2 +- .../2019-04-25-suspicious_file_write.md | 2 +- ...9-10-11-prohibited_software_on_endpoint.md | 2 +- ...credential_dumping_through_lsass_access.md | 2 +- ...-03-detect_mimikatz_using_loaded_images.md | 2 +- ...6-access_lsass_memory_for_dump_creation.md | 2 +- ...9-12-06-create_remote_thread_into_lsass.md | 2 +- ...19-12-06-unsigned_image_loaded_by_lsass.md | 2 +- ...-03-creation_of_lsass_dump_with_taskmgr.md | 2 +- .../2020-03-16-detect_rare_executables.md | 2 +- ...0-first_time_seen_child_process_of_zoom.md | 2 +- .../2020-07-06-windows_event_log_cleared.md | 2 +- ...20-07-08-detect_new_local_admin_account.md | 2 +- ..._to_phishing_sites_leveraging_evilginx2.md | 10 +- ...web_traffic_to_dynamic_domain_providers.md | 2 +- ...ce_modified_with_previously_unseen_user.md | 2 +- ...first_time_seen_running_windows_service.md | 2 +- ...-suspicious_email_attachment_extensions.md | 2 +- ...ous_writes_to_system_volume_information.md | 2 +- ...20-07-22-uncommon_processes_on_endpoint.md | 2 +- ...ct_windows_dns_sigred_via_splunk_stream.md | 2 +- ...tivity_related_to_pass_the_hash_attacks.md | 2 +- ...2020-11-09-common_ransomware_extensions.md | 2 +- .../2020-11-09-common_ransomware_notes.md | 2 +- ..._system_network_configuration_discovery.md | 2 +- ...rohibited_applications_spawning_cmd_exe.md | 4 +- ...processes_run_from_unexpected_locations.md | 2 +- ...burst_correlation_dll_and_network_event.md | 2 +- ...cious_microsoft_workflow_compiler_usage.md | 2 +- ..._connecting_to_dynamic_domain_providers.md | 2 +- .../2021-01-20-suspicious_mshta_spawn.md | 2 +- ...ect_regsvr32_application_control_bypass.md | 2 +- ...cious_regsvr32_register_suspicious_path.md | 2 +- ...21-02-01-dump_lsass_via_procdump_rename.md | 2 +- ...21-03-12-ransomware_notes_bulk_creation.md | 2 +- ...3-16-high_process_termination_frequency.md | 2 +- ...16-windows_high_file_deletion_frequency.md | 2 +- ...3-17-clop_ransomware_known_service_name.md | 2 +- ...021-03-23-certutil_with_decode_argument.md | 2 +- ...021-03-31-disabling_firewall_with_netsh.md | 2 +- ...icious_powershell_executed_as_a_service.md | 2 +- ...heduled_task_created_within_public_path.md | 2 +- ...t_scheduled_task_created_to_spawn_shell.md | 2 +- ...-office_document_creating_schedule_task.md | 2 +- ...14-office_document_executing_macro_code.md | 2 +- ..._remote_thread_to_known_windows_process.md | 2 +- ...hedule_task_with_http_command_arguments.md | 2 +- ...dule_task_with_rundll32_command_trigger.md | 2 +- ...9-wermgr_process_create_executable_file.md | 2 +- .../_posts/2021-04-22-winword_spawning_cmd.md | 2 +- ...-04-26-office_product_spawning_certutil.md | 2 +- ...021-04-26-office_product_spawning_mshta.md | 2 +- docs/_posts/2021-04-26-trickbot_named_pipe.md | 2 +- ...021-04-29-suspicious_driver_loaded_path.md | 2 +- docs/_posts/2021-04-29-xmrig_driver_loaded.md | 2 +- ...21-05-04-process_kill_base_on_file_path.md | 2 +- ...021-05-06-download_files_using_telegram.md | 2 +- ...merate_users_local_group_using_telegram.md | 2 +- ...05-12-delete_shadowcopy_with_powershell.md | 2 +- ...2021-05-13-cmlua_or_cmstplua_uac_bypass.md | 2 +- ...-allow_inbound_traffic_in_firewall_rule.md | 2 +- .../2021-05-19-mailsniper_invoke_functions.md | 2 +- .../2021-05-20-cmd_echo_pipe_-_escalation.md | 2 +- .../2021-06-02-modification_of_wallpaper.md | 2 +- ...021-06-02-wbemprox_com_object_execution.md | 2 +- ...-04-known_services_killed_by_ransomware.md | 2 +- ...ss_process_injection_via_getprocaddress.md | 2 +- ..._script_contains_base64_encoded_content.md | 2 +- ...re_with_powershell_script_block_logging.md | 2 +- ...tz_with_powershell_script_block_logging.md | 2 +- ...021-06-09-unloading_amsi_via_reflection.md | 2 +- ...-06-10-powershell_creating_thread_mutex.md | 2 +- ...021-06-10-powershell_domain_enumeration.md | 2 +- ...ading_dotnet_into_memory_via_reflection.md | 2 +- ...10-powershell_processing_stream_of_data.md | 2 +- .../2021-06-10-recon_using_wmi_class.md | 2 +- ...4-wmi_recon_running_process_or_services.md | 2 +- ...tect_wmi_event_subscription_persistence.md | 2 +- ...7-suspicious_event_log_service_behavior.md | 2 +- ...-powershell_enable_smb1protocol_feature.md | 2 +- ...ursive_delete_of_directory_in_batch_cmd.md | 2 +- ...w_file_and_printing_sharing_in_firewall.md | 2 +- ...-23-allow_network_discovery_in_firewall.md | 2 +- ...4-excessive_usage_of_sc_service_utility.md | 2 +- ...07-01-spoolsv_suspicious_loaded_modules.md | 6 +- ...07-01-spoolsv_suspicious_process_access.md | 2 +- ...21-07-01-spoolsv_writing_a_dll_-_sysmon.md | 2 +- ...-07-12-uac_bypass_mmc_load_unsigned_dll.md | 2 +- ...a_spawning_rundll32_or_regsvr32_process.md | 2 +- ...-07-19-office_product_spawn_cmd_process.md | 2 +- ...of_shadowcopy_with_script_block_logging.md | 2 +- ...-rundll32_createremotethread_in_browser.md | 2 +- ...rundll32_process_creating_exe_dll_files.md | 2 +- ...gsvr32_with_known_silent_switch_cmdline.md | 2 +- ...dll32_create_remote_thread_to_a_process.md | 2 +- .../2021-07-30-drop_icedid_license_dat.md | 2 +- ...edid_exfiltrated_archived_file_creation.md | 2 +- ...fice_application_spawn_regsvr32_process.md | 2 +- ...2021-08-03-sqlite_module_in_temp_folder.md | 2 +- ...eate_remote_thread_in_shell_application.md | 2 +- ...8-13-uac_bypass_with_colorui_com_object.md | 2 +- docs/_posts/2021-08-18-esentutl_sam_copy.md | 2 +- ...9-aws_ecr_container_upload_unknown_user.md | 2 +- ...1-08-20-github_commit_changes_in_master.md | 2 +- ...2021-08-20-kubernetes_nginx_ingress_lfi.md | 2 +- ...er_account_with_powershell_script_block.md | 2 +- ...2021-08-23-kubernetes_nginx_ingress_rfi.md | 2 +- ...21-08-24-adsisearcher_account_discovery.md | 2 +- ...omaintrust_with_powershell_script_block.md | 2 +- ...get_aduser_with_powershell_script_block.md | 2 +- ...ct_ds_user_with_powershell_script_block.md | 2 +- ...omain_group_discovery_with_adsisearcher.md | 2 +- ...elevated_group_discovery_with_powerview.md | 2 +- ...t_ds_group_with_powershell_script_block.md | 2 +- ...wordpolicy_with_powershell_script_block.md | 2 +- ...mainpolicy_with_powershell_script_block.md | 2 +- ...omaingroup_with_powershell_script_block.md | 2 +- ...8-27-exchange_powershell_abuse_via_ssrf.md | 2 +- ...-08-27-exchange_powershell_module_usage.md | 2 +- ...petitpotam_network_share_access_request.md | 2 +- ...itpotam_suspicious_kerberos_tgt_request.md | 2 +- ...adcomputer_with_powershell_script_block.md | 2 +- ...s_computer_with_powershell_script_block.md | 2 +- .../2021-09-01-github_commit_in_develop.md | 2 +- .../2021-09-01-github_dependabot_alert.md | 2 +- ...1-github_pull_request_from_unknown_user.md | 2 +- ...mote_system_discovery_with_adsisearcher.md | 2 +- ...oresttrust_with_powershell_script_block.md | 2 +- ...incomputer_with_powershell_script_block.md | 2 +- ...controller_with_powershell_script_block.md | 2 +- ...e_by_app_connect_and_create_adsi_object.md | 2 +- ...2021-09-09-extraction_of_registry_hives.md | 2 +- ...connection_with_powershell_script_block.md | 2 +- ...s_scripting_process_loading_ldap_module.md | 2 +- ...ms_scripting_process_loading_wmi_module.md | 2 +- ...21-09-13-xsl_script_execution_with_wmic.md | 2 +- ...oup_discovery_with_script_block_logging.md | 2 +- ...me_process_accessing_chrome_default_dir.md | 2 +- ...efox_process_access_firefox_profile_dir.md | 2 +- ...t_to_add_certificate_to_untrusted_store.md | 2 +- ...edential_dump_from_registry_via_reg_exe.md | 4 +- ...of_shadow_copy_with_wmic_and_powershell.md | 2 +- ...mping_via_copy_command_from_shadow_copy.md | 2 +- ...tial_dumping_via_symlink_to_shadow_copy.md | 2 +- ...16-detect_html_help_url_in_command_line.md | 2 +- ...ml_help_using_infotech_storage_handlers.md | 2 +- ...09-16-detect_mshta_inline_hta_execution.md | 2 +- ...-09-16-detect_mshta_url_in_command_line.md | 2 +- ...9-16-detect_psexec_with_accepteula_flag.md | 2 +- .../2021-09-16-dump_lsass_via_procdump.md | 2 +- ...09-16-local_account_discovery_with_wmic.md | 2 +- ...2021-09-16-office_product_spawning_wmic.md | 2 +- .../2021-09-16-processes_launching_netsh.md | 2 +- .../2021-09-29-verclsid_clsid_execution.md | 2 +- ...32_silent_and_install_param_dll_loading.md | 2 +- ...rincipalnames_discovery_with_powershell.md | 2 +- ...iceprincipalnames_discovery_with_setspn.md | 2 +- ...ows_task_scheduler_event_action_started.md | 2 +- .../2021-11-11-wmic_xsl_execution_via_url.md | 2 +- ...21-11-12-csc_net_on_the_fly_compilation.md | 2 +- ...twork_discovery_using_route_windows_app.md | 2 +- ...12-remote_process_instantiation_via_wmi.md | 2 +- ...21-11-12-runas_execution_in_commandline.md | 2 +- ...12-windows_installutil_uninstall_option.md | 2 +- ...windows_installutil_url_in_command_line.md | 2 +- ...ion_via_wmi_and_powershell_script_block.md | 2 +- ...ile_written_in_administrative_smb_share.md | 2 +- .../2021-11-18-loading_of_dynwrapx_module.md | 2 +- ...info_gathering_using_dxdiag_application.md | 2 +- ...ce_created_with_suspicious_service_path.md | 2 +- ...dows_service_created_within_public_path.md | 2 +- ...ell_windows_defender_exclusion_commands.md | 2 +- ...-11-29-detect_rclone_command-line_usage.md | 2 +- ...-msi_module_loaded_by_non-system_binary.md | 2 +- .../2021-12-13-linux_java_spawning_shell.md | 2 +- ..._hunting_system_account_targeting_lsass.md | 2 +- ...dows_non-system_account_targeting_lsass.md | 2 +- ...-cmd_carry_out_string_command_parameter.md | 2 +- ...shell_remove_windows_defender_directory.md | 2 +- ...cess_dns_query_known_abuse_web_services.md | 2 +- ...dows_dotnet_binary_in_non_standard_path.md | 2 +- ...indows_installutil_in_non_standard_path.md | 2 +- ...ive_file_deletion_in_windefender_folder.md | 2 +- .../2022-01-20-ping_sleep_batch_command.md | 2 +- .../2022-01-24-windows_nirsoft_utilities.md | 2 +- ...-27-windows_possible_credential_dumping.md | 2 +- ...nload_with_urlcache_and_split_arguments.md | 2 +- ...load_with_verifyctl_and_split_arguments.md | 2 +- ..._ticket_exports_through_winlogon_access.md | 2 +- ...7-windows_schtasks_create_run_as_system.md | 2 +- ...oasting_spn_request_with_rc4_encryption.md | 2 +- ...2-15-windows_diskshadow_proxy_execution.md | 2 +- ..._raw_access_to_master_boot_record_drive.md | 2 +- ...8-detect_regasm_with_network_connection.md | 2 +- ...-detect_regsvcs_with_network_connection.md | 2 +- ...authentication_discovery_with_powerview.md | 2 +- ...-process_deleting_its_process_file_path.md | 2 +- docs/_posts/2022-02-18-rundll32_dnsquery.md | 2 +- ...uthentication_discovery_with_get-aduser.md | 2 +- ...2-02-22-windows_wmi_process_call_create.md | 2 +- ...ndows_excessive_disabled_services_event.md | 2 +- ...ows_raw_access_to_disk_volume_partition.md | 2 +- docs/_posts/2022-03-04-macos_lolbin.md | 2 +- ...t_regasm_with_no_command_line_arguments.md | 2 +- ..._regsvcs_with_no_command_line_arguments.md | 2 +- ...ice_ticket_request_using_rc4_encryption.md | 2 +- ...cious_dllhost_no_command_line_arguments.md | 2 +- ...ious_gpupdate_no_command_line_arguments.md | 2 +- ...s_installutil_remote_network_connection.md | 2 +- ...stallutil_uninstall_option_with_network.md | 2 +- ...wordpolicy_with_powershell_script_block.md | 2 +- ...domainuser_with_powershell_script_block.md | 2 +- ...oup_discovery_with_script_block_logging.md | 2 +- ...getadgroup_with_powershell_script_block.md | 2 +- ...rrent_user_with_powershell_script_block.md | 2 +- ...tlocaluser_with_powershell_script_block.md | 2 +- ...sion_on_remote_endpoint_with_powershell.md | 2 +- ...ntication_flag_disabled_with_powershell.md | 2 +- ...022-03-22-powershell_execute_com_object.md | 2 +- ...owershell_using_memory_as_backing_store.md | 2 +- ...3-22-recon_avproduct_through_pwh_or_wmi.md | 2 +- ...on_via_dcom_and_powershell_script_block.md | 2 +- ...n_via_winrm_and_powershell_script_block.md | 2 +- ...y_with_env_vars_powershell_script_block.md | 2 +- ...uter_unconstrained_delegation_discovery.md | 2 +- ...view_unconstrained_delegation_discovery.md | 2 +- ...03-28-windows_terminating_lsass_process.md | 2 +- ...-30-windows_drivers_loaded_by_signature.md | 2 +- ...erview_constrained_delegation_discovery.md | 2 +- ...ithub_actions_disable_security_workflow.md | 2 +- ...4-windows_driver_load_non-standard_path.md | 2 +- ...4-04-windows_event_for_service_disabled.md | 2 +- ...022-04-18-nltest_domain_trust_discovery.md | 2 +- ...rocesses_killed_by_industroyer2_malware.md | 2 +- ...ndows_linked_policies_in_adsi_discovery.md | 2 +- ...s_root_domain_linked_policies_discovery.md | 2 +- ...6-windows_hidden_schedule_task_settings.md | 2 +- ...ter_account_created_by_computer_account.md | 2 +- ...uter_account_requesting_kerberos_ticket.md | 2 +- ...windows_kerberos_local_successful_logon.md | 2 +- ...04-28-windows_computer_account_with_spn.md | 2 +- ...-02-windows_krbrelayup_service_creation.md | 2 +- .../2022-05-16-cobalt_strike_named_pipes.md | 2 +- ...nd_scripting_interpreter_risky_commands.md | 181 +++++++ ...rsonation_weak_encryption_simplerequest.md | 162 +++++++ ...-splunk_identified_ssl_tls_certificates.md | 166 +++++++ ...rsonation_weak_encryption_configuration.md | 167 +++++++ docs/_posts/2022-05-26-macos_plutil.md | 2 +- ...tal_certificates_infrastructure_version.md | 165 +++++++ ...digital_certificates_lack_of_encryption.md | 165 +++++++ ...ss_injection_forwarder_bundle_downloads.md | 166 +++++++ ...mpersonation_weak_encryption_selfsigned.md | 162 +++++++ ..._and_scripting_interpreter_delete_usage.md | 170 +++++++ ...nd_scripting_interpreter_risky_spl_mltk.md | 176 +++++++ ...01-mshtml_module_load_in_office_product.md | 170 +++++++ ...spicious_process_with_discord_dns_query.md | 170 +++++++ ...ess_connecting_to_ip_check_web_services.md | 165 +++++++ ...01-windows_installutil_credential_theft.md | 171 +++++++ ...2-06-03-excessive_usage_of_nslookup_app.md | 2 +- docs/_stories/splunk_vulnerabilities.md | 13 +- docs/mitre-map/coverage.json | 40 +- 284 files changed, 3274 insertions(+), 300 deletions(-) create mode 100644 docs/_pages/splunk_audit.md create mode 100644 docs/_posts/2022-05-23-splunk_command_and_scripting_interpreter_risky_commands.md create mode 100644 docs/_posts/2022-05-24-splunk_protocol_impersonation_weak_encryption_simplerequest.md create mode 100644 docs/_posts/2022-05-25-splunk_identified_ssl_tls_certificates.md create mode 100644 docs/_posts/2022-05-25-splunk_protocol_impersonation_weak_encryption_configuration.md create mode 100644 docs/_posts/2022-05-26-splunk_digital_certificates_infrastructure_version.md create mode 100644 docs/_posts/2022-05-26-splunk_digital_certificates_lack_of_encryption.md create mode 100644 docs/_posts/2022-05-26-splunk_process_injection_forwarder_bundle_downloads.md create mode 100644 docs/_posts/2022-05-26-splunk_protocol_impersonation_weak_encryption_selfsigned.md create mode 100644 docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_delete_usage.md create mode 100644 docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_risky_spl_mltk.md create mode 100644 docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md create mode 100644 docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md create mode 100644 docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md create mode 100644 docs/_posts/2022-06-01-windows_installutil_credential_theft.md diff --git a/dist/escu/app.manifest b/dist/escu/app.manifest index 731920e356..beca1e0b1d 100644 --- a/dist/escu/app.manifest +++ b/dist/escu/app.manifest @@ -5,7 +5,7 @@ "id": { "group": null, "name": "DA-ESS-ContentUpdate", - "version": "3.42.0" + "version": "3.43.0" }, "author": [ { diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf index dba4e07934..20055617d0 100644 --- a/dist/escu/default/analyticstories.conf +++ b/dist/escu/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-06-06T20:50:08 UTC +# On Date: 2022-06-14T13:52:57 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -17,6 +17,56 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp known_false_positives = This search may find additional path traversal exploitation attempts. providing_technologies = [] +[savedsearch://ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule] +type = detection +asset_type = Web Server +confidence = medium +explanation = The following analytic identifies the use of the risky command - Delete - that may be utilized in Splunk to delete some or all data queried for. In order to use Delete in Splunk, one must be assigned the role. This is typically not used and should generate an anomaly if it is used. +how_to_implement = To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]} +known_false_positives = False positives may be present if this command is used as a common practice. Filter as needed. +providing_technologies = [] + +[savedsearch://ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule] +type = detection +asset_type = Web Server +confidence = medium +explanation = The Splunk platform contains built-in search processing language (SPL) safeguards to warn you when you are about to unknowingly run a search that contains commands that might be a security risk. This warning appears when you click a link or type a URL that loads a search that contains risky commands. The warning does not appear when you create ad hoc searches. This warning alerts you to the possibility of unauthorized actions by a malicious user. Unauthorized actions include - Copying or transferring data (data exfiltration), Deleting data and Overwriting data. All risky commands may be found here https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga. A possible scenario when this might occur is when a malicious actor creates a search that includes commands that exfiltrate or damage data. The malicious actor then sends an unsuspecting user a link to the search. The URL contains a query string (q) and a search identifier (sid), but the sid is not valid. The malicious actor hopes the user will use the link and the search will run. During analysis, pivot based on user name and filter any user or queries not needed. Queries ran from a dashboard are seen as adhoc queries. When a query runs from a dashboard it will not show in audittrail logs the source dashboard name. The query defaults to adhoc and no Splunk system user activity. In addition, modify this query by removing key commands that generate too much noise, or too little, and create separate queries with higher confidence to alert on. +how_to_implement = To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]} +known_false_positives = False positives will be present until properly filtered by Username and search name. +providing_technologies = [] + +[savedsearch://ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule] +type = detection +asset_type = Web Server +confidence = medium +explanation = This detection utilizes machine learning model named "risky_command_abuse" trained from "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline". It should be scheduled to run hourly to detect whether a user has run searches containing risky SPL from this list https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga with abnormally long running time in the past one hour, comparing with his/her past seven days history. This search uses the trained baseline to infer whether a search is an outlier (isOutlier ~= 1.0) or not (isOutlier~= 0.0) +how_to_implement = This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Baseline model needs to be built using "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline" before this search can run. Please note that the current search only finds matches exactly one space between separator bar and risky commands. +annotations = {"cis20": ["CIS 3", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.AE"]} +known_false_positives = If the run time of a search exceeds the boundaries of outlier defined by the fitted density function model, false positives can occur, incorrectly labeling a long running search as potentially risky. +providing_technologies = [] + +[savedsearch://ESCU - Splunk Digital Certificates Infrastructure Version - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = This search will check the TLS validation is properly configured on the search head it is run from as well as its search peers after Splunk version 9. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. +how_to_implement = The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) in some architectures. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1587.003"], "nist": ["DE.CM"]} +known_false_positives = No known at this time. +providing_technologies = [] + +[savedsearch://ESCU - Splunk Digital Certificates Lack of Encryption - Rule] +type = detection +asset_type = endpoint +confidence = medium +explanation = On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. The fixes for these require upgrading to at least Splunk 9.0 on the forwarder as well. This is a great opportunity to configure TLS across the environment. This search looks for forwarders that are not using TLS and adds risk to those entities. +how_to_implement = This anomaly search looks for forwarder connections that are not currently using TLS. It then presents the source IP, the type of forwarder, and the version of the forwarder. You can also remove the "ssl=false" argument from the initial stanza in order to get a full list of all your forwarders that are sending data, and the version of Splunk software they are running, for audit purposes. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1587.003"], "nist": ["DE.CM"]} +known_false_positives = None at this time +providing_technologies = [] + [savedsearch://ESCU - Splunk DoS via Malformed S2S Request - Rule] type = detection asset_type = Endpoint @@ -27,6 +77,46 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp known_false_positives = None. providing_technologies = [] +[savedsearch://ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. This hunting search pulls a full list of forwarder bundle downloads where the peer column is the forwarder, the host column is the Deployment Server, and then you have a list of the apps downloaded and the serverclasses in which the peer is a member of. You should look for apps or clients that you do not recognize as being part of your environment. +how_to_implement = This hunting search uses native logs produced when a deployment server is within your environment. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "nist": ["DE.CM"]} +known_false_positives = None at this time. +providing_technologies = [] + +[savedsearch://ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = On June 14th, 2022, Splunk released a security advisory relating to TLS validation occuring within the httplib and urllib python libraries shipped with Splunk. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. In addition to these settings, the PYTHONHTTPSVERIFY setting in $SPLUNK_HOME/etc/splunk-launch.conf needs to be enabled as well. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. +how_to_implement = The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (The `dispatch_rest_to_indexers` capability). Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1001.003"], "nist": ["DE.CM"]} +known_false_positives = While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration. +providing_technologies = [] + +[savedsearch://ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates. +how_to_implement = Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1588.004"], "nist": ["DE.CM"]} +known_false_positives = This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward. +providing_technologies = [] + +[savedsearch://ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = On Splunk version 9 on Python3 client libraries verify server certificates by default and use CA certificate store. This search warns a user about a failure to validate a certificate using python3 request. +how_to_implement = Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1588.004"], "nist": ["DE.CM"]} +known_false_positives = This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. +providing_technologies = [] + [savedsearch://ESCU - Splunk User Enumeration Attempt - Rule] type = detection asset_type = endpoint @@ -9099,6 +9189,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.00 known_false_positives = unknown providing_technologies = [] +[savedsearch://ESCU - Splunk Identified SSL TLS Certificates - Rule] +type = detection +asset_type = Proxy +confidence = medium +explanation = The following analytic uses tags of SSL, TLS and certificate to identify the usage of the Splunk default certificates being utilized in the environment. Recommended guidance is to utilize valid TLS certificates which documentation may be found in Splunk Docs - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL. +how_to_implement = Ingestion of SSL/TLS data is needed and to be tagged properly as ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1040"], "nist": ["DE.CM"]} +known_false_positives = False positives will not be present as it is meant to assist with identifying default certificates being utilized. +providing_technologies = [] + [savedsearch://ESCU - Confluence Unauthenticated Remote Code Execution CVE-2022-26134 - Rule] type = detection asset_type = Web Server @@ -10487,7 +10587,7 @@ version = 1 references = ["https://www.splunk.com/en_us/product-security/announcements.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Lou Stella"}] spec_version = 3 -searches = ["ESCU - Path traversal SPL injection - Rule", "ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Splunk User Enumeration Attempt - Rule", "ESCU - Splunk XSS in Monitoring Console - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule"] +searches = ["ESCU - Path traversal SPL injection - Rule", "ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule", "ESCU - Splunk Digital Certificates Infrastructure Version - Rule", "ESCU - Splunk Digital Certificates Lack of Encryption - Rule", "ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule", "ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule", "ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule", "ESCU - Splunk User Enumeration Attempt - Rule", "ESCU - Splunk XSS in Monitoring Console - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Splunk Identified SSL TLS Certificates - Rule"] description = Keeping your Splunk Enterprise deployment up to date is critical and will help you reduce the risk associated with vulnerabilities in the product. narrative = This analytic story includes detections that focus on attacker behavior targeted at your Splunk environment directly. diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf index f3e75d5dc0..9e5df9e53a 100644 --- a/dist/escu/default/app.conf +++ b/dist/escu/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 8166 +build = 8305 [triggers] reload.analytic_stories = simple @@ -20,7 +20,7 @@ reload.es_investigations = simple [launcher] author = Splunk -version = 3.42.0 +version = 3.43.0 description = Explore the Analytic Stories included with ES Content Updates. [ui] diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index 6385ce639b..57d68c71fa 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-06-06T20:50:08 UTC +# On Date: 2022-06-14T13:52:57 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/content-version.conf b/dist/escu/default/content-version.conf index 305cdc9464..0be9e35fe9 100644 --- a/dist/escu/default/content-version.conf +++ b/dist/escu/default/content-version.conf @@ -1,2 +1,2 @@ [content-version] -version = 3.42.0 +version = 3.43.0 diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf index b38bf7c285..3c88f0a809 100644 --- a/dist/escu/default/es_investigations.conf +++ b/dist/escu/default/es_investigations.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-06-06T20:50:08 UTC +# On Date: 2022-06-14T13:52:57 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 330a659e90..b63225caef 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-06-06T20:50:08 UTC +# On Date: 2022-06-14T13:52:57 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -9,10 +9,46 @@ definition = search * description = Update this macro to limit the output results to filter out false positives. +[splunk_command_and_scripting_interpreter_delete_usage_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[splunk_command_and_scripting_interpreter_risky_commands_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[splunk_command_and_scripting_interpreter_risky_spl_mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[splunk_digital_certificates_infrastructure_version_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[splunk_digital_certificates_lack_of_encryption_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [splunk_dos_via_malformed_s2s_request_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. +[splunk_process_injection_forwarder_bundle_downloads_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[splunk_protocol_impersonation_weak_encryption_configuration_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[splunk_protocol_impersonation_weak_encryption_selfsigned_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[splunk_protocol_impersonation_weak_encryption_simplerequest_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [splunk_user_enumeration_attempt_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -3545,6 +3581,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[splunk_identified_ssl_tls_certificates_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [confluence_unauthenticated_remote_code_execution_cve_2022_26134_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -3863,7 +3903,7 @@ definition = "-70m@m" description = Use this macro to determine how far back you should be checking for new provisioning activities [printservice] -definition = source="wineventlog:microsoft-windows-printservice/operational" OR sourcetype="WinEventLog:Microsoft-Windows-PrintService/Admin" +definition = source="wineventlog:microsoft-windows-printservice/operational" OR source="WinEventLog:Microsoft-Windows-PrintService/Admin" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [process_bitsadmin] @@ -4071,6 +4111,10 @@ description = This macro is a list of AWS event names associated with security g definition = index=signals description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +[splunk_python] +definition = index=_internal sourcetype=splunk_python +description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. + [splunkd] definition = index=_internal sourcetype=splunkd description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 806359d4a1..68584dab81 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-06-06T20:50:08 UTC +# On Date: 2022-06-14T13:52:57 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -52,6 +52,206 @@ realtime_schedule = 0 is_visible = false search = `path_traversal_spl_injection` | search "\/..\/..\/..\/..\/..\/..\/..\/..\/..\/" | stats count by status clientip method uri_path uri_query | `path_traversal_spl_injection_filter` +[ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies the use of the risky command - Delete - that may be utilized in Splunk to delete some or all data queried for. In order to use Delete in Splunk, one must be assigned the role. This is typically not used and should generate an anomaly if it is used. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]} +action.escu.data_models = ["Splunk_Audit"] +action.escu.eli5 = The following analytic identifies the use of the risky command - Delete - that may be utilized in Splunk to delete some or all data queried for. In order to use Delete in Splunk, one must be assigned the role. This is typically not used and should generate an anomaly if it is used. +action.escu.how_to_implement = To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. +action.escu.known_false_positives = False positives may be present if this command is used as a common practice. Filter as needed. +action.escu.creation_date = 2022-05-27 +action.escu.modification_date = 2022-05-27 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Splunk Vulnerabilities"] +action.risk = 1 +action.risk.param._risk_message = $user$ executed the 'delete' command, if this is unexpected it should be reviewed. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule +action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 30, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32154"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| delete*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_delete_usage_filter` + +[ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The Splunk platform contains built-in search processing language (SPL) safeguards to warn you when you are about to unknowingly run a search that contains commands that might be a security risk. This warning appears when you click a link or type a URL that loads a search that contains risky commands. The warning does not appear when you create ad hoc searches. This warning alerts you to the possibility of unauthorized actions by a malicious user. Unauthorized actions include - Copying or transferring data (data exfiltration), Deleting data and Overwriting data. All risky commands may be found here https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga. A possible scenario when this might occur is when a malicious actor creates a search that includes commands that exfiltrate or damage data. The malicious actor then sends an unsuspecting user a link to the search. The URL contains a query string (q) and a search identifier (sid), but the sid is not valid. The malicious actor hopes the user will use the link and the search will run. During analysis, pivot based on user name and filter any user or queries not needed. Queries ran from a dashboard are seen as adhoc queries. When a query runs from a dashboard it will not show in audittrail logs the source dashboard name. The query defaults to adhoc and no Splunk system user activity. In addition, modify this query by removing key commands that generate too much noise, or too little, and create separate queries with higher confidence to alert on. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]} +action.escu.data_models = ["Splunk_Audit"] +action.escu.eli5 = The Splunk platform contains built-in search processing language (SPL) safeguards to warn you when you are about to unknowingly run a search that contains commands that might be a security risk. This warning appears when you click a link or type a URL that loads a search that contains risky commands. The warning does not appear when you create ad hoc searches. This warning alerts you to the possibility of unauthorized actions by a malicious user. Unauthorized actions include - Copying or transferring data (data exfiltration), Deleting data and Overwriting data. All risky commands may be found here https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga. A possible scenario when this might occur is when a malicious actor creates a search that includes commands that exfiltrate or damage data. The malicious actor then sends an unsuspecting user a link to the search. The URL contains a query string (q) and a search identifier (sid), but the sid is not valid. The malicious actor hopes the user will use the link and the search will run. During analysis, pivot based on user name and filter any user or queries not needed. Queries ran from a dashboard are seen as adhoc queries. When a query runs from a dashboard it will not show in audittrail logs the source dashboard name. The query defaults to adhoc and no Splunk system user activity. In addition, modify this query by removing key commands that generate too much noise, or too little, and create separate queries with higher confidence to alert on. +action.escu.how_to_implement = To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +action.escu.known_false_positives = False positives will be present until properly filtered by Username and search name. +action.escu.creation_date = 2022-05-23 +action.escu.modification_date = 2022-05-23 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Splunk Vulnerabilities"] +action.risk = 1 +action.risk.param._risk_message = A risky Splunk command has ran by $user$ and should be reviewed. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 20}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule +action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 40, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32154"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type | `drop_dm_object_name(Search_Activity)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `splunk_command_and_scripting_interpreter_risky_commands_filter` + +[ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This detection utilizes machine learning model named "risky_command_abuse" trained from "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline". It should be scheduled to run hourly to detect whether a user has run searches containing risky SPL from this list https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga with abnormally long running time in the past one hour, comparing with his/her past seven days history. This search uses the trained baseline to infer whether a search is an outlier (isOutlier ~= 1.0) or not (isOutlier~= 0.0) +action.escu.mappings = {"cis20": ["CIS 3", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.AE"]} +action.escu.data_models = ["Splunk_Audit"] +action.escu.eli5 = This detection utilizes machine learning model named "risky_command_abuse" trained from "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline". It should be scheduled to run hourly to detect whether a user has run searches containing risky SPL from this list https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga with abnormally long running time in the past one hour, comparing with his/her past seven days history. This search uses the trained baseline to infer whether a search is an outlier (isOutlier ~= 1.0) or not (isOutlier~= 0.0) +action.escu.how_to_implement = This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Baseline model needs to be built using "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline" before this search can run. Please note that the current search only finds matches exactly one space between separator bar and risky commands. +action.escu.known_false_positives = If the run time of a search exceeds the boundaries of outlier defined by the fitted density function model, false positives can occur, incorrectly labeling a long running search as potentially risky. +action.escu.creation_date = 2022-05-27 +action.escu.modification_date = 2022-05-27 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Splunk Vulnerabilities"] +action.risk = 1 +action.risk.param._risk_message = Abnormally long run time for risk SPL command seen by user $(Search_Activity.user). +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 20}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule +action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 6"], "confidence": 40, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32154"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats sum(Search_Activity.total_run_time) AS run_time, values(Search_Activity.search) as searches, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") AND (Search_Activity.total_run_time>1) AND (earliest=-1h@h latest=now) AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*")) AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) BY _time, Search_Activity.user span=1h | apply risky_command_abuse | fields _time, Search_Activity.user, searches, run_time, IsOutlier(run_time) | rename IsOutlier(run_time) as isOutlier, _time as timestamp | where isOutlier>0.5 | `splunk_command_and_scripting_interpreter_risky_spl_mltk_filter` + +[ESCU - Splunk Digital Certificates Infrastructure Version - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search will check the TLS validation is properly configured on the search head it is run from as well as its search peers after Splunk version 9. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1587.003"], "nist": ["DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = This search will check the TLS validation is properly configured on the search head it is run from as well as its search peers after Splunk version 9. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. +action.escu.how_to_implement = The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) in some architectures. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +action.escu.known_false_positives = No known at this time. +action.escu.creation_date = 2022-05-26 +action.escu.modification_date = 2022-05-26 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Splunk Digital Certificates Infrastructure Version - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Splunk Vulnerabilities"] +action.risk = 1 +action.risk.param._risk_message = $splunk_server$ may not be properly validating TLS Certificates +action.risk.param._risk = [{"risk_object_field": "splunk_server", "risk_object_type": "system", "risk_score": 50}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Splunk Digital Certificates Infrastructure Version - Rule +action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32153"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1587.003"], "nist": ["DE.CM"], "observable": [{"name": "splunk_server", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="sslConfig"| table splunk_server sslVerifyServerCert sslVerifyServerName serverCert] | fillnull value="Not Set" | rename sslVerifyServerCert as "Server.conf:SslConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:SslConfig:sslVerifyServerName", serverCert as "Server.conf:SslConfig:serverCert" | `splunk_digital_certificates_infrastructure_version_filter` + +[ESCU - Splunk Digital Certificates Lack of Encryption - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. The fixes for these require upgrading to at least Splunk 9.0 on the forwarder as well. This is a great opportunity to configure TLS across the environment. This search looks for forwarders that are not using TLS and adds risk to those entities. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1587.003"], "nist": ["DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. The fixes for these require upgrading to at least Splunk 9.0 on the forwarder as well. This is a great opportunity to configure TLS across the environment. This search looks for forwarders that are not using TLS and adds risk to those entities. +action.escu.how_to_implement = This anomaly search looks for forwarder connections that are not currently using TLS. It then presents the source IP, the type of forwarder, and the version of the forwarder. You can also remove the "ssl=false" argument from the initial stanza in order to get a full list of all your forwarders that are sending data, and the version of Splunk software they are running, for audit purposes. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +action.escu.known_false_positives = None at this time +action.escu.creation_date = 2022-05-26 +action.escu.modification_date = 2022-05-26 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Splunk Digital Certificates Lack of Encryption - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Splunk Vulnerabilities"] +action.risk = 1 +action.risk.param._risk_message = $hostname$ is not using TLS when forwarding data +action.risk.param._risk = [{"risk_object_field": "hostname", "risk_object_type": "system", "risk_score": 20}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Splunk Digital Certificates Lack of Encryption - Rule +action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32151"], "impact": 25, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1587.003"], "nist": ["DE.CM"], "observable": [{"name": "hostname", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `splunkd` group="tcpin_connections" ssl="false" | stats values(sourceIp) latest(fwdType) latest(version) by hostname | `splunk_digital_certificates_lack_of_encryption_filter` + [ESCU - Splunk DoS via Malformed S2S Request - Rule] action.escu = 0 action.escu.enabled = 1 @@ -98,6 +298,166 @@ realtime_schedule = 0 is_visible = false search = `splunkd` log_level="ERROR" component="TcpInputProc" thread_name="FwdDataReceiverThread" "Invalid _meta atom" | table host, src | `splunk_dos_via_malformed_s2s_request_filter` +[ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. This hunting search pulls a full list of forwarder bundle downloads where the peer column is the forwarder, the host column is the Deployment Server, and then you have a list of the apps downloaded and the serverclasses in which the peer is a member of. You should look for apps or clients that you do not recognize as being part of your environment. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "nist": ["DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. This hunting search pulls a full list of forwarder bundle downloads where the peer column is the forwarder, the host column is the Deployment Server, and then you have a list of the apps downloaded and the serverclasses in which the peer is a member of. You should look for apps or clients that you do not recognize as being part of your environment. +action.escu.how_to_implement = This hunting search uses native logs produced when a deployment server is within your environment. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +action.escu.known_false_positives = None at this time. +action.escu.creation_date = 2022-05-26 +action.escu.modification_date = 2022-05-26 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Splunk Vulnerabilites"] +action.risk = 1 +action.risk.param._risk_message = $peer$ downloaded apps from $host$ +action.risk.param._risk = [{"risk_object_field": "host", "risk_object_type": "system", "risk_score": 35}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule +action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilites"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32157", "CVE-2022-32158"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "nist": ["DE.CM"], "observable": [{"name": "host", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `splunkd` component="PackageDownloadRestHandler" | stats values(app) values(serverclass) by peer, host | `splunk_process_injection_forwarder_bundle_downloads_filter` + +[ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = On June 14th, 2022, Splunk released a security advisory relating to TLS validation occuring within the httplib and urllib python libraries shipped with Splunk. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. In addition to these settings, the PYTHONHTTPSVERIFY setting in $SPLUNK_HOME/etc/splunk-launch.conf needs to be enabled as well. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1001.003"], "nist": ["DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = On June 14th, 2022, Splunk released a security advisory relating to TLS validation occuring within the httplib and urllib python libraries shipped with Splunk. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. In addition to these settings, the PYTHONHTTPSVERIFY setting in $SPLUNK_HOME/etc/splunk-launch.conf needs to be enabled as well. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. +action.escu.how_to_implement = The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (The `dispatch_rest_to_indexers` capability). Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +action.escu.known_false_positives = While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration. +action.escu.creation_date = 2022-05-25 +action.escu.modification_date = 2022-05-25 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Splunk Vulnerabilities"] +action.risk = 1 +action.risk.param._risk_message = $splunk_server$ may not be properly validating TLS Certificates +action.risk.param._risk = [{"risk_object_field": "splunk_server", "risk_object_type": "system", "risk_score": 50}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule +action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32151"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1001.003"], "nist": ["DE.CM"], "observable": [{"name": "splunk_server", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | rest /services/server/info | table splunk_server version server_roles | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-server/ search="PythonSslClientConfig" | table splunk_server sslVerifyServerCert sslVerifyServerName] | join splunk_server [| rest /servicesNS/nobody/search/configs/conf-web/settings | table splunk_server serverCert sslVersions] | rename sslVerifyServerCert as "Server.conf:PythonSSLClientConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:PythonSSLClientConfig:sslVerifyServerName", serverCert as "Web.conf:Settings:serverCert", sslVersions as "Web.conf:Settings:sslVersions" | `splunk_protocol_impersonation_weak_encryption_configuration_filter` + +[ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1588.004"], "nist": ["DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates. +action.escu.how_to_implement = Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +action.escu.known_false_positives = This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward. +action.escu.creation_date = 2022-05-26 +action.escu.modification_date = 2022-05-26 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Splunk Vulnerabilities"] +action.risk = 1 +action.risk.param._risk_message = Splunk default issued certificate at $host$ +action.risk.param._risk = [{"risk_object_field": "Hostname", "risk_object_type": "system", "risk_score": 40}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule +action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32152"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1588.004"], "nist": ["DE.CM"], "observable": [{"name": "Hostname", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `splunkd` certificate event_message="X509 certificate* should not be used*" | stats count by host CN component log_level | `splunk_protocol_impersonation_weak_encryption_selfsigned_filter` + +[ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = On Splunk version 9 on Python3 client libraries verify server certificates by default and use CA certificate store. This search warns a user about a failure to validate a certificate using python3 request. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1588.004"], "nist": ["DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = On Splunk version 9 on Python3 client libraries verify server certificates by default and use CA certificate store. This search warns a user about a failure to validate a certificate using python3 request. +action.escu.how_to_implement = Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +action.escu.known_false_positives = This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. +action.escu.creation_date = 2022-05-24 +action.escu.modification_date = 2022-05-24 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Splunk Vulnerabilities"] +action.risk = 1 +action.risk.param._risk_message = Failed to validate certificate on $host$ +action.risk.param._risk = [{"risk_object_field": "Hostname", "risk_object_type": "system", "risk_score": 40}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule +action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32152"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1588.004"], "nist": ["DE.CM"], "observable": [{"name": "Hostname", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" | stats count by host path | `splunk_protocol_impersonation_weak_encryption_simplerequest_filter` + [ESCU - Splunk User Enumeration Attempt - Rule] action.escu = 0 action.escu.enabled = 1 @@ -20635,8 +20995,8 @@ action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following detection identifies the module load of mshtml.dll into an Office product. This behavior has been related to CVE-2021-40444, whereas the malicious document will load ActiveX, which activates the MSHTML component. The vulnerability resides in the MSHTML component. During triage, identify parallel processes and capture any file modifications for analysis. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process names and image loads from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. action.escu.known_false_positives = Limited false positives will be present, however, tune as necessary. -action.escu.creation_date = 2021-09-09 -action.escu.modification_date = 2021-09-09 +action.escu.creation_date = 2022-06-01 +action.escu.modification_date = 2022-06-01 action.escu.confidence = high action.escu.full_search_name = ESCU - MSHTML Module Load in Office Product - Rule action.escu.search_type = detection @@ -20670,7 +21030,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventID=7 process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, ImageLoaded, OriginalFileName, process_id | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mshtml_module_load_in_office_product_filter` +search = `sysmon` EventID=7 process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, ImageLoaded, OriginalFileName, ProcessGuid | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mshtml_module_load_in_office_product_filter` [ESCU - MSI Module Loaded by Non-System Binary - Rule] action.escu = 0 @@ -27245,7 +27605,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventCode=7 Image ="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*" ImageLoaded = "*.dll" | stats dc(ImageLoaded) as countImgloaded values(ImageLoaded) as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer process_id EventCode | where countImgloaded >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_suspicious_loaded_modules_filter` +search = `sysmon` EventCode=7 Image ="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*" ImageLoaded = "*.dll" | stats dc(ImageLoaded) as countImgloaded values(ImageLoaded) as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer ProcessId EventCode | where countImgloaded >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_suspicious_loaded_modules_filter` [ESCU - Spoolsv Suspicious Process Access - Rule] action.escu = 0 @@ -28305,8 +28665,8 @@ action.escu.data_models = ["Endpoint"] action.escu.eli5 = This analytic identifies a process making a DNS query to Discord, a well known instant messaging and digital distribution platform. Discord can be abused by adversaries, as seen in the WhisperGate campaign, to host and download malicious. external files. A process resolving a Discord DNS name could be an indicator of malware trying to download files from Discord for further execution. action.escu.how_to_implement = his detection relies on sysmon logs with the Event ID 22, DNS Query. action.escu.known_false_positives = Noise and false positive can be seen if the following instant messaging is allowed to use within corporate network. In this case, a filter is needed. -action.escu.creation_date = 2022-01-19 -action.escu.modification_date = 2022-01-19 +action.escu.creation_date = 2022-06-01 +action.escu.modification_date = 2022-06-01 action.escu.confidence = high action.escu.full_search_name = ESCU - Suspicious Process With Discord DNS Query - Rule action.escu.search_type = detection @@ -28334,7 +28694,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventCode=22 QueryName IN ("*discord*") process_path != "*\\AppData\\Local\\Discord\\*" AND process_path != "*\\Program Files*" AND process_name != "discord.exe" | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name QueryResults Computer process_path | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_with_discord_dns_query_filter` +search = `sysmon` EventCode=22 QueryName IN ("*discord*") Image != "*\\AppData\\Local\\Discord\\*" AND Image != "*\\Program Files*" AND Image != "discord.exe" | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name QueryResults Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_with_discord_dns_query_filter` [ESCU - Suspicious Reg exe Process - Rule] action.escu = 0 @@ -29961,8 +30321,8 @@ action.escu.data_models = ["Endpoint"] action.escu.eli5 = this search is designed to detect suspicious wermgr.exe process that tries to connect to known IP web services. This technique is know for trickbot and other trojan spy malware to recon the infected machine and look for its ip address without so much finger print on the commandline process. Since wermgr.exe is designed for error handling process of windows it is really suspicious that this process is trying to connect to this IP web services cause that maybe cause of some malicious code injection. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from your endpoints like EventCode 22. If you are using Sysmon, you must have at least version 12 of the Sysmon TA. action.escu.known_false_positives = unknown -action.escu.creation_date = 2021-04-19 -action.escu.modification_date = 2021-04-19 +action.escu.creation_date = 2022-06-01 +action.escu.modification_date = 2022-06-01 action.escu.confidence = high action.escu.full_search_name = ESCU - Wermgr Process Connecting To IP Check Web Services - Rule action.escu.search_type = detection @@ -29996,7 +30356,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net") | stats min(_time) as firstTime max(_time) as lastTime count by process_path process_name process_id QueryName QueryStatus QueryResults Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_connecting_to_ip_check_web_services_filter` +search = `sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net") | stats min(_time) as firstTime max(_time) as lastTime count by Image process_name ProcessId QueryName QueryStatus QueryResults Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_connecting_to_ip_check_web_services_filter` [ESCU - Wermgr Process Create Executable File - Rule] action.escu = 0 @@ -31787,8 +32147,8 @@ If used by a developer, typically this will be found with multiple command-line During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and module loads from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. action.escu.known_false_positives = Typically this will not trigger as by it's very nature InstallUtil does not need credentials. Filter as needed. -action.escu.creation_date = 2021-11-12 -action.escu.modification_date = 2021-11-12 +action.escu.creation_date = 2022-06-01 +action.escu.modification_date = 2022-06-01 action.escu.confidence = high action.escu.full_search_name = ESCU - Windows InstallUtil Credential Theft - Rule action.escu.search_type = detection @@ -31825,7 +32185,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventCode=7 process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll", "*\\vaultcli.dll") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, ImageLoaded, OriginalFileName, process_id | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_credential_theft_filter` +search = `sysmon` EventCode=7 process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll", "*\\vaultcli.dll") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, ImageLoaded, OriginalFileName, ProcessId | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_credential_theft_filter` [ESCU - Windows InstallUtil in Non Standard Path - Rule] action.escu = 0 @@ -39256,6 +39616,46 @@ realtime_schedule = 0 is_visible = false search = `stream_http` http_method=POST form_data IN ("*wermgr.exe*","*svchost.exe*", "*name=\"proclist\"*","*ipconfig*", "*name=\"sysinfo\"*", "*net view*") |stats values(form_data) as http_request_body min(_time) as firstTime max(_time) as lastTime count by http_method http_user_agent uri_path url bytes_in bytes_out | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `plain_http_post_exfiltrated_data_filter` +[ESCU - Splunk Identified SSL TLS Certificates - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic uses tags of SSL, TLS and certificate to identify the usage of the Splunk default certificates being utilized in the environment. Recommended guidance is to utilize valid TLS certificates which documentation may be found in Splunk Docs - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL. +action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1040"], "nist": ["DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic uses tags of SSL, TLS and certificate to identify the usage of the Splunk default certificates being utilized in the environment. Recommended guidance is to utilize valid TLS certificates which documentation may be found in Splunk Docs - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL. +action.escu.how_to_implement = Ingestion of SSL/TLS data is needed and to be tagged properly as ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. +action.escu.known_false_positives = False positives will not be present as it is meant to assist with identifying default certificates being utilized. +action.escu.creation_date = 2022-05-25 +action.escu.modification_date = 2022-05-25 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Splunk Identified SSL TLS Certificates - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Splunk Vulnerabilities"] +action.risk = 1 +action.risk.param._risk_message = The following $dest$ is using the self signed Splunk certificate. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Splunk Identified SSL TLS Certificates - Rule +action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Application Log"], "cve": ["CVE-2022-32151", "CVE-2022-32152"], "impact": 60, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1040"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = tag IN (ssl, tls, certificate) ssl_issuer_common_name=*splunk* | stats values(src) AS "Host(s) with Default Cert" count by ssl_issuer ssl_subject_common_name ssl_subject_organization ssl_subject host sourcetype | `splunk_identified_ssl_tls_certificates_filter` + [ESCU - Confluence Unauthenticated Remote Code Execution CVE-2022-26134 - Rule] action.escu = 0 action.escu.enabled = 1 @@ -40954,6 +41354,28 @@ disabled = true is_visible = false search = | tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest| `drop_dm_object_name(Processes)` | table firstTimeSeen, lastTimeSeen, process_name, dest | inputlookup zoom_first_time_child_process append=t | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by process_name, dest | where lastTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_forget_window`") | outputlookup zoom_first_time_child_process +[ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline +description = This search supports an analyst looking for abuse or misuse of the risky commands listed here: https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning This is accomplished by using the time spent executing one of these risky commands as a proxy for misuse/abuse of interest during investigation and/or hunting. The search builds a model utilizes the MLTK DensityFunction algorithm on Splunk app audit log data. The model uses the past 7 days of user history executing the above referenced commands then aggregates the total search run time for each hour as indicator of user behavior. The model identifies the top 0.1% of user search run time, indicating a risky use of these commands. Users can adjust this threshold 0.1% as interested however this will correlate to missed/false positive rates. This search should be scheduled to run at least every 7 days. The name of machine learning model generated is "risky_command_abuse" and should be configured to be globally shared (not private) in MLTK app as documented here: https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Models#Sharing_models_from_other_Splunk_apps unless the same account of training this model will be used to perform inference using this model for anomaly detection. +action.escu.creation_date = 2022-05-27 +action.escu.modification_date = 2022-05-27 +action.escu.analytic_story = ["Splunk Vulnerabilities"] +action.escu.data_models = ["Splunk_Audit"] +cron_schedule = 0 * * * * +enableSched = 1 +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search supports an analyst looking for abuse or misuse of the risky commands listed here: https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning This is accomplished by using the time spent executing one of these risky commands as a proxy for misuse/abuse of interest during investigation and/or hunting. The search builds a model utilizes the MLTK DensityFunction algorithm on Splunk app audit log data. The model uses the past 7 days of user history executing the above referenced commands then aggregates the total search run time for each hour as indicator of user behavior. The model identifies the top 0.1% of user search run time, indicating a risky use of these commands. Users can adjust this threshold 0.1% as interested however this will correlate to missed/false positive rates. This search should be scheduled to run at least every 7 days. The name of machine learning model generated is "risky_command_abuse" and should be configured to be globally shared (not private) in MLTK app as documented here: https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Models#Sharing_models_from_other_Splunk_apps unless the same account of training this model will be used to perform inference using this model for anomaly detection. +action.escu.how_to_implement = The corresponding detection of using this model is "Splunk Command and Scripting Interpreter Risky SPL MLTK". This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and it assumes Splunk accelerated audit data model is available. For large enterprises, training the model might take significant computing resources. It might require dedicated search head. The underlined machine learning algorithm this detection used is DensityFunction. It might need to increase its settings default values, such as max_fit_time, max_groups, etc. More details of achieving optimal performance and configuring DensityFunction parameters can be found here - https://docs.splunk.com/Documentation/MLApp/5.3.1/User/Configurefitandapply Users can modify earliest=-7d@d in the search to other value so that the search can collect enough data points to build a good baseline model. Users can also modify list of risky commands in "Search_Activity.search IN" to better suit users' violation policy and their usage environment. +disabled = true +is_visible = false +search = | tstats sum(Search_Activity.total_run_time) as run_time, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now) AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscolle*")) AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) BY _time, Search_Activity.user span=1h | fit DensityFunction "run_time" dist=auto lower_threshold=0.000001 upper_threshold=0.001 show_density=true by Search_Activity.user into "risky_command_abuse" + [ESCU - Systems Ready for Spectre-Meltdown Windows Patch] action.escu = 0 action.escu.enabled = 1 diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index ead268f0d4..0d34ae2dc9 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-06-06T20:50:08 UTC +# On Date: 2022-06-14T13:52:57 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/workflow_actions.conf b/dist/escu/default/workflow_actions.conf index 9ef141aaa8..6e310d4fdc 100644 --- a/dist/escu/default/workflow_actions.conf +++ b/dist/escu/default/workflow_actions.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-06-06T20:50:08 UTC +# On Date: 2022-06-14T13:52:57 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/docs/_data/navigation.yml b/docs/_data/navigation.yml index 386f85e71a..6c3f138879 100644 --- a/docs/_data/navigation.yml +++ b/docs/_data/navigation.yml @@ -60,6 +60,8 @@ detections: url: /detections/network_traffic/ - title: Risk url: /detections/risk/ + - title: Splunk_Audit + url: /detections/splunk_audit/ - title: UEBA url: /detections/ueba/ - title: Updates diff --git a/docs/_pages/detections.md b/docs/_pages/detections.md index e35b0f6062..e72b9fbb63 100644 --- a/docs/_pages/detections.md +++ b/docs/_pages/detections.md @@ -692,10 +692,20 @@ sidebar: | [Single Letter Process On Endpoint](/endpoint/single_letter_process_on_endpoint/) | [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Spectre and Meltdown Vulnerable Systems](/deprecated/spectre_and_meltdown_vulnerable_systems/) | None | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Spike in File Writes](/endpoint/spike_in_file_writes/) | None | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Splunk Command and Scripting Interpreter Delete Usage](/application/splunk_command_and_scripting_interpreter_delete_usage/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Splunk Command and Scripting Interpreter Risky Commands](/application/splunk_command_and_scripting_interpreter_risky_commands/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Splunk Command and Scripting Interpreter Risky SPL MLTK](/application/splunk_command_and_scripting_interpreter_risky_spl_mltk/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Splunk Digital Certificates Infrastructure Version](/application/splunk_digital_certificates_infrastructure_version/) | [Digital Certificates](/tags/#digital-certificates) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Splunk Digital Certificates Lack of Encryption](/application/splunk_digital_certificates_lack_of_encryption/) | [Digital Certificates](/tags/#digital-certificates) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Splunk DoS via Malformed S2S Request](/application/splunk_dos_via_malformed_s2s_request/) | [Network Denial of Service](/tags/#network-denial-of-service) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Splunk Enterprise Information Disclosure](/deprecated/splunk_enterprise_information_disclosure/) | None | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Splunk Identified SSL TLS Certificates](/network/splunk_identified_ssl_tls_certificates/) | [Network Sniffing](/tags/#network-sniffing) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Splunk Process Injection Forwarder Bundle Downloads](/application/splunk_process_injection_forwarder_bundle_downloads/) | [Process Injection](/tags/#process-injection) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Splunk Protocol Impersonation Weak Encryption Configuration](/application/splunk_protocol_impersonation_weak_encryption_configuration/) | [Protocol Impersonation](/tags/#protocol-impersonation) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Splunk User Enumeration Attempt](/application/splunk_user_enumeration_attempt/) | [Valid Accounts](/tags/#valid-accounts) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Splunk XSS in Monitoring Console](/application/splunk_xss_in_monitoring_console/) | [Drive-by Compromise](/tags/#drive-by-compromise) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Splunk protocol impersonation weak encryption selfsigned](/application/splunk_protocol_impersonation_weak_encryption_selfsigned/) | [Digital Certificates](/tags/#digital-certificates) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | +| [Splunk protocol impersonation weak encryption simplerequest](/application/splunk_protocol_impersonation_weak_encryption_simplerequest/) | [Digital Certificates](/tags/#digital-certificates) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Spoolsv Spawning Rundll32](/endpoint/spoolsv_spawning_rundll32/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Spoolsv Suspicious Loaded Modules](/endpoint/spoolsv_suspicious_loaded_modules/) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | | [Spoolsv Suspicious Process Access](/endpoint/spoolsv_suspicious_process_access/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) | diff --git a/docs/_pages/splunk_audit.md b/docs/_pages/splunk_audit.md new file mode 100644 index 0000000000..7613bed97f --- /dev/null +++ b/docs/_pages/splunk_audit.md @@ -0,0 +1,9 @@ +--- +title: Splunk_Audit +layout: tag +author_profile: false +taxonomy: Splunk_Audit +permalink: /detections/splunk_audit/ +sidebar: + nav: "detections" +--- \ No newline at end of file diff --git a/docs/_pages/stories.md b/docs/_pages/stories.md index 9d241a8a92..18efa21234 100644 --- a/docs/_pages/stories.md +++ b/docs/_pages/stories.md @@ -109,7 +109,7 @@ sidebar: | [Silver Sparrow](silver_sparrow) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Launch Agent](/tags/#launch-agent), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Data Staged](/tags/#data-staged) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Spearphishing Attachments](spearphishing_attachments) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Spearphishing Link](/tags/#spearphishing-link), [Malicious Link](/tags/#malicious-link), [User Execution](/tags/#user-execution) | [Credential Access](/tags/#credential-access), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access) | | [Spectre And Meltdown Vulnerabilities](spectre_and_meltdown_vulnerabilities) | None | None | -| [Splunk Vulnerabilities](splunk_vulnerabilities) | [File and Directory Discovery](/tags/#file-and-directory-discovery), [Network Denial of Service](/tags/#network-denial-of-service), [Valid Accounts](/tags/#valid-accounts), [Drive-by Compromise](/tags/#drive-by-compromise) | [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | +| [Splunk Vulnerabilities](splunk_vulnerabilities) | [File and Directory Discovery](/tags/#file-and-directory-discovery), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Digital Certificates](/tags/#digital-certificates), [Network Denial of Service](/tags/#network-denial-of-service), [Protocol Impersonation](/tags/#protocol-impersonation), [Digital Certificates](/tags/#digital-certificates), [Valid Accounts](/tags/#valid-accounts), [Drive-by Compromise](/tags/#drive-by-compromise), [Network Sniffing](/tags/#network-sniffing) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Resource Development](/tags/#resource-development) | | [Spring4Shell CVE-2022-22965](spring4shell_cve-2022-22965) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Web Shell](/tags/#web-shell), [Server Software Component](/tags/#server-software-component) | [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) | | [Suspicious AWS EC2 Activities](suspicious_aws_ec2_activities) | [Cloud Accounts](/tags/#cloud-accounts), [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Suspicious AWS Login Activities](suspicious_aws_login_activities) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions), [Cloud Accounts](/tags/#cloud-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | diff --git a/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md b/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md index d485eb70b4..64449b47a3 100644 --- a/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md +++ b/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md @@ -99,8 +99,8 @@ This search returns a list of hosts that have not successfully completed a backu #### Macros The SPL above uses the following Macros: -* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml) > :information_source: > **extended_period_without_successful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md b/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md index 31a66e2bfa..14cc93f2cc 100644 --- a/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md +++ b/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md @@ -98,8 +98,8 @@ This search gives you the hosts where a backup was attempted and then failed. #### Macros The SPL above uses the following Macros: -* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml) > :information_source: > **unsuccessful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md index 351df8d65f..5860da8991 100644 --- a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md @@ -95,8 +95,8 @@ This search looks for DNS requests for faux domains similar to the domains that #### Macros The SPL above uses the following Macros: -* [brand_abuse_dns](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_dns.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [brand_abuse_dns](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_dns.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md index e9ed6c984d..051f22e654 100644 --- a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md @@ -100,8 +100,8 @@ This search looks for Web requests to faux domains similar to the one that you w #### Macros The SPL above uses the following Macros: -* [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md index ba87d130b6..bbb21c3187 100644 --- a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md +++ b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md @@ -124,8 +124,8 @@ This search will detect users creating spikes in API activity related to securit #### Macros The SPL above uses the following Macros: -* [security_group_api_calls](https://github.com/splunk/security_content/blob/develop/macros/security_group_api_calls.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) +* [security_group_api_calls](https://github.com/splunk/security_content/blob/develop/macros/security_group_api_calls.yml) > :information_source: > **detect_spike_in_security_group_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md index 473271fdc1..f4a348e37c 100644 --- a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md +++ b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md @@ -118,8 +118,8 @@ This search looks at S3 bucket-access logs and detects new or previously unseen #### Macros The SPL above uses the following Macros: -* [aws_s3_accesslogs](https://github.com/splunk/security_content/blob/develop/macros/aws_s3_accesslogs.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [aws_s3_accesslogs](https://github.com/splunk/security_content/blob/develop/macros/aws_s3_accesslogs.yml) > :information_source: > **detect_s3_access_from_a_new_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md index 7ddc9ec68b..5604b56488 100644 --- a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md @@ -114,8 +114,8 @@ This search looks for the creation of WMI permanent event subscriptions. #### Macros The SPL above uses the following Macros: -* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml) > :information_source: > **wmi_permanent_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md index 02ca8ce578..71d6f444e4 100644 --- a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md @@ -113,8 +113,8 @@ This search looks for the creation of WMI temporary event subscriptions. #### Macros The SPL above uses the following Macros: -* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml) > :information_source: > **wmi_temporary_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md index e330d0107c..7f77a75359 100644 --- a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md +++ b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md @@ -110,8 +110,8 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md b/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md index dae186beec..47ee78a2f2 100644 --- a/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md +++ b/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md @@ -112,8 +112,8 @@ This search looks for PowerShell requesting privileges consistent with credentia #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **detect_mimikatz_via_powershell_and_eventcode_4703_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-04-25-suspicious_file_write.md b/docs/_posts/2019-04-25-suspicious_file_write.md index d7830d2ff0..aed242ad09 100644 --- a/docs/_posts/2019-04-25-suspicious_file_write.md +++ b/docs/_posts/2019-04-25-suspicious_file_write.md @@ -99,8 +99,8 @@ The search looks for files created with names that have been linked to malicious #### Macros The SPL above uses the following Macros: -* [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md index 661feb67e5..87c524140d 100644 --- a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md +++ b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md @@ -103,8 +103,8 @@ This search looks for applications on the endpoint that you have marked as prohi #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [prohibited_softwares](https://github.com/splunk/security_content/blob/develop/macros/prohibited_softwares.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **prohibited_software_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md index 875ff5b43e..be75b3546b 100644 --- a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md +++ b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md @@ -114,8 +114,8 @@ This search looks for reading lsass memory consistent with credential dumping. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_credential_dumping_through_lsass_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md index 445b0aa8ec..3de046b373 100644 --- a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md +++ b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md @@ -113,8 +113,8 @@ This search looks for reading loaded Images unique to credential dumping with Mi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_mimikatz_using_loaded_images_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md index 6228d32f4a..ade57132a5 100644 --- a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md +++ b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md @@ -111,8 +111,8 @@ Detect memory dumping of the LSASS process. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **access_lsass_memory_for_dump_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md index 01a8bca88b..be36a668be 100644 --- a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md +++ b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md @@ -111,8 +111,8 @@ Detect remote thread creation into LSASS consistent with credential dumping. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **create_remote_thread_into_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md index 6ce1a2e91d..f7818c9cf6 100644 --- a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md +++ b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md @@ -106,8 +106,8 @@ This search detects loading of unsigned images by LSASS. Deprecated because too #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **unsigned_image_loaded_by_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md index e89e183dd1..d877cebd94 100644 --- a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md +++ b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md @@ -111,8 +111,8 @@ Detect the hands on keyboard behavior of Windows Task Manager creating a process #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **creation_of_lsass_dump_with_taskmgr_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-03-16-detect_rare_executables.md b/docs/_posts/2020-03-16-detect_rare_executables.md index 49ce545359..7b015eb774 100644 --- a/docs/_posts/2020-03-16-detect_rare_executables.md +++ b/docs/_posts/2020-03-16-detect_rare_executables.md @@ -114,8 +114,8 @@ This search will return a table of rare processes, the names of the systems runn #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_rare_executables_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md index 4a05b41d21..1164dc80d2 100644 --- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md +++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md @@ -114,8 +114,8 @@ This search looks for child processes spawned by zoom.exe or zoom.us that has no #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [previously_seen_zoom_child_processes_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_zoom_child_processes_window.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **first_time_seen_child_process_of_zoom_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-06-windows_event_log_cleared.md b/docs/_posts/2020-07-06-windows_event_log_cleared.md index 610808a839..3f3ed50d37 100644 --- a/docs/_posts/2020-07-06-windows_event_log_cleared.md +++ b/docs/_posts/2020-07-06-windows_event_log_cleared.md @@ -115,9 +115,9 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve #### Macros The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_event_log_cleared_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-08-detect_new_local_admin_account.md b/docs/_posts/2020-07-08-detect_new_local_admin_account.md index b14f43e277..3e6512d9d8 100644 --- a/docs/_posts/2020-07-08-detect_new_local_admin_account.md +++ b/docs/_posts/2020-07-08-detect_new_local_admin_account.md @@ -113,8 +113,8 @@ This search looks for newly created accounts that have been elevated to local ad #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **detect_new_local_admin_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md index 540303dc4e..c51c767f06 100644 --- a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md +++ b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md @@ -123,14 +123,14 @@ This search looks for DNS requests for phishing domains that are leveraging Evil #### Macros The SPL above uses the following Macros: -* [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml) -* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml) -* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml) -* [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml) * [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml) +* [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml) +* [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml) +* [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml) +* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml) +* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml) * [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml) > :information_source: > **detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md index da4c4419a2..9a0b7389ef 100644 --- a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md +++ b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md @@ -109,8 +109,8 @@ This search looks for web connections to dynamic DNS providers. #### Macros The SPL above uses the following Macros: -* [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md index a3f8704de8..7706e0d302 100644 --- a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md +++ b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md @@ -118,8 +118,8 @@ This search looks for EC2 instances being modified by users who have not previou #### Macros The SPL above uses the following Macros: -* [ec2_modification_api_calls](https://github.com/splunk/security_content/blob/develop/macros/ec2_modification_api_calls.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [ec2_modification_api_calls](https://github.com/splunk/security_content/blob/develop/macros/ec2_modification_api_calls.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: diff --git a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md index 3f454963e2..97977c0cfd 100644 --- a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md +++ b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md @@ -118,8 +118,8 @@ This search looks for the first and last time a Windows service is seen running #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [previously_seen_windows_services_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_windows_services_window.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **first_time_seen_running_windows_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md index a9d2a15203..7032505da1 100644 --- a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md +++ b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md @@ -117,8 +117,8 @@ This search looks for emails that have attachments with suspicious file extensio #### Macros The SPL above uses the following Macros: -* [suspicious_email_attachments](https://github.com/splunk/security_content/blob/develop/macros/suspicious_email_attachments.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [suspicious_email_attachments](https://github.com/splunk/security_content/blob/develop/macros/suspicious_email_attachments.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md index 9b0f587725..2ba8eb08fa 100644 --- a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md +++ b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md @@ -104,8 +104,8 @@ This search detects writes to the 'System Volume Information' folder by somethin #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_writes_to_system_volume_information_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md index 11e77acc60..d5664f0705 100644 --- a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md +++ b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md @@ -108,8 +108,8 @@ This search looks for applications on the endpoint that you have marked as uncom #### Macros The SPL above uses the following Macros: -* [uncommon_processes](https://github.com/splunk/security_content/blob/develop/macros/uncommon_processes.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [uncommon_processes](https://github.com/splunk/security_content/blob/develop/macros/uncommon_processes.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md index 906d51e1ca..ed73e8c274 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md @@ -117,8 +117,8 @@ This search detects SIGRed via Splunk Stream. #### Macros The SPL above uses the following Macros: -* [stream_tcp](https://github.com/splunk/security_content/blob/develop/macros/stream_tcp.yml) * [stream_dns](https://github.com/splunk/security_content/blob/develop/macros/stream_dns.yml) +* [stream_tcp](https://github.com/splunk/security_content/blob/develop/macros/stream_tcp.yml) > :information_source: > **detect_windows_dns_sigred_via_splunk_stream_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md index d7016c612e..8afe9011b3 100644 --- a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md +++ b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md @@ -117,8 +117,8 @@ This search looks for specific authentication events from the Windows Security E #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **detect_activity_related_to_pass_the_hash_attacks_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-09-common_ransomware_extensions.md b/docs/_posts/2020-11-09-common_ransomware_extensions.md index dc37dca253..5ef412da61 100644 --- a/docs/_posts/2020-11-09-common_ransomware_extensions.md +++ b/docs/_posts/2020-11-09-common_ransomware_extensions.md @@ -110,8 +110,8 @@ The search looks for file modifications with extensions commonly used by Ransomw #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [ransomware_extensions](https://github.com/splunk/security_content/blob/develop/macros/ransomware_extensions.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **common_ransomware_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-09-common_ransomware_notes.md b/docs/_posts/2020-11-09-common_ransomware_notes.md index 315432c79b..02e4d5a45d 100644 --- a/docs/_posts/2020-11-09-common_ransomware_notes.md +++ b/docs/_posts/2020-11-09-common_ransomware_notes.md @@ -109,8 +109,8 @@ The search looks for files created with names matching those typically used in r #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [ransomware_notes](https://github.com/splunk/security_content/blob/develop/macros/ransomware_notes.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **common_ransomware_notes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md index f3728f515c..c0b41eca2c 100644 --- a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md +++ b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md @@ -113,8 +113,8 @@ This search looks for fast execution of processes used for system network config #### Macros The SPL above uses the following Macros: -* [system_network_configuration_discovery_tools](https://github.com/splunk/security_content/blob/develop/macros/system_network_configuration_discovery_tools.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [system_network_configuration_discovery_tools](https://github.com/splunk/security_content/blob/develop/macros/system_network_configuration_discovery_tools.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md index d2ce551ed0..5e95657880 100644 --- a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md +++ b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md @@ -113,9 +113,9 @@ This search looks for executions of cmd.exe spawned by a process that is often a #### Macros The SPL above uses the following Macros: -* [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md index 617e428b64..4ae024d1ea 100644 --- a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md +++ b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md @@ -116,8 +116,8 @@ During triage, review the parallel processes - what process moved the native Win #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [is_windows_system_file](https://github.com/splunk/security_content/blob/develop/macros/is_windows_system_file.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **system_processes_run_from_unexpected_locations_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md index fd49f87ac7..7e4aa6a628 100644 --- a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md +++ b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md @@ -110,8 +110,8 @@ The malware sunburst will load the malicious dll by SolarWinds.BusinessLayerHost #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **sunburst_correlation_dll_and_network_event_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md index 56ad8afeab..a9eda9f12e 100644 --- a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md +++ b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md @@ -108,8 +108,8 @@ The following analytic identifies microsoft.workflow.compiler.exe usage. microso #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_microsoft_workflow_compiler_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md index f3ff99120f..acb9fc9e9c 100644 --- a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md +++ b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md @@ -113,8 +113,8 @@ Malicious actors often abuse legitimate Dynamic DNS services to host malicious p #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [dynamic_dns_providers](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_providers.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_hosts_connecting_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md index c1aa23acd7..7c5c6ff72c 100644 --- a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md +++ b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md @@ -112,8 +112,8 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior #### Macros The SPL above uses the following Macros: -* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md index bf8e91a006..6c37af2788 100644 --- a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md +++ b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md @@ -113,8 +113,8 @@ Upon investigating, look for network connections to remote destinations (interna #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md index 67902820ae..f9cf1a3efd 100644 --- a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md +++ b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md @@ -112,8 +112,8 @@ Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md index f790f144d3..beea6f235b 100644 --- a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md +++ b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md @@ -108,8 +108,8 @@ During triage, confirm this is procdump.exe executing. If it is the first time a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **dump_lsass_via_procdump_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md index 18070e75e0..620ce0a918 100644 --- a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md +++ b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md @@ -103,8 +103,8 @@ The following analytics identifies a big number of instance of ransomware notes #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **ransomware_notes_bulk_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-16-high_process_termination_frequency.md b/docs/_posts/2021-03-16-high_process_termination_frequency.md index d4cf37746f..db41bf7dfa 100644 --- a/docs/_posts/2021-03-16-high_process_termination_frequency.md +++ b/docs/_posts/2021-03-16-high_process_termination_frequency.md @@ -103,8 +103,8 @@ This analytics are designed to indentify a high frequency of process termination #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **high_process_termination_frequency_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md index b73da35928..5ac8414b89 100644 --- a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md +++ b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md @@ -102,8 +102,8 @@ This search looks for high frequency of file deletion relative to process name a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_high_file_deletion_frequency_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md index 0b7fdfe081..20649a78c8 100644 --- a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md +++ b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md @@ -102,8 +102,8 @@ This detection is to identify the common service name created by the CLOP ransom #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **clop_ransomware_known_service_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-23-certutil_with_decode_argument.md b/docs/_posts/2021-03-23-certutil_with_decode_argument.md index af163128da..b7495a6ba1 100644 --- a/docs/_posts/2021-03-23-certutil_with_decode_argument.md +++ b/docs/_posts/2021-03-23-certutil_with_decode_argument.md @@ -102,8 +102,8 @@ CertUtil.exe may be used to `encode` and `decode` a file, including PE and scrip #### Macros The SPL above uses the following Macros: -* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md index f0359f53c9..9484c6a320 100644 --- a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md +++ b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md @@ -107,8 +107,8 @@ This search is to identifies suspicious firewall disabling using netsh applicati #### Macros The SPL above uses the following Macros: -* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md index ab261f4d7d..ebd16db17c 100644 --- a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md +++ b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md @@ -115,8 +115,8 @@ This detection is to identify the abuse the Windows SC.exe to execute malicious #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **malicious_powershell_executed_as_a_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md index 8298ca7fc7..6809b34a14 100644 --- a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md +++ b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md @@ -115,8 +115,8 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or was it v #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **winevent_scheduled_task_created_within_public_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md index 5ff4bdb821..fa288d86e1 100644 --- a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md +++ b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md @@ -115,8 +115,8 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or via Task #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **winevent_scheduled_task_created_to_spawn_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md index bef8758516..56c059af2a 100644 --- a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md +++ b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md @@ -106,8 +106,8 @@ this search detects a potential malicious office document that create schedule t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **office_document_creating_schedule_task_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-14-office_document_executing_macro_code.md b/docs/_posts/2021-04-14-office_document_executing_macro_code.md index eeb3ab4fee..d2d52c4271 100644 --- a/docs/_posts/2021-04-14-office_document_executing_macro_code.md +++ b/docs/_posts/2021-04-14-office_document_executing_macro_code.md @@ -106,8 +106,8 @@ this detection was designed to identifies suspicious office documents that using #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **office_document_executing_macro_code_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md index 000c69e486..85a2c57319 100644 --- a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md +++ b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md @@ -102,8 +102,8 @@ this search is designed to detect suspicious powershell process that tries to in #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **powershell_remote_thread_to_known_windows_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md index b297562c89..3518e5e547 100644 --- a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md +++ b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md @@ -105,8 +105,8 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **schedule_task_with_http_command_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md index 80da349bf8..323536440f 100644 --- a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md +++ b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md @@ -105,8 +105,8 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **schedule_task_with_rundll32_command_trigger_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md index caf4fa1b8e..a3a7e05749 100644 --- a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md +++ b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md @@ -101,8 +101,8 @@ this search is designed to detect potential malicious wermgr.exe process that dr #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **wermgr_process_create_executable_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-22-winword_spawning_cmd.md b/docs/_posts/2021-04-22-winword_spawning_cmd.md index cd8bc91dff..1d6f90aadf 100644 --- a/docs/_posts/2021-04-22-winword_spawning_cmd.md +++ b/docs/_posts/2021-04-22-winword_spawning_cmd.md @@ -107,8 +107,8 @@ The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-04-26-office_product_spawning_certutil.md b/docs/_posts/2021-04-26-office_product_spawning_certutil.md index 68372ed7a1..aee81a0e17 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_certutil.md +++ b/docs/_posts/2021-04-26-office_product_spawning_certutil.md @@ -107,8 +107,8 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: -* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-04-26-office_product_spawning_mshta.md b/docs/_posts/2021-04-26-office_product_spawning_mshta.md index 5fda55ea06..23dc5d2084 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_mshta.md +++ b/docs/_posts/2021-04-26-office_product_spawning_mshta.md @@ -107,8 +107,8 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: -* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-04-26-trickbot_named_pipe.md b/docs/_posts/2021-04-26-trickbot_named_pipe.md index cc29fc4eab..895a6c51d5 100644 --- a/docs/_posts/2021-04-26-trickbot_named_pipe.md +++ b/docs/_posts/2021-04-26-trickbot_named_pipe.md @@ -102,8 +102,8 @@ this search is to detect potential trickbot infection through the create/connect #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **trickbot_named_pipe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md index ff1e142ac3..43c3a38d63 100644 --- a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md +++ b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md @@ -108,8 +108,8 @@ This analytic will detect suspicious driver loaded paths. This technique is comm #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_driver_loaded_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-29-xmrig_driver_loaded.md b/docs/_posts/2021-04-29-xmrig_driver_loaded.md index 7046351428..aea92238c8 100644 --- a/docs/_posts/2021-04-29-xmrig_driver_loaded.md +++ b/docs/_posts/2021-04-29-xmrig_driver_loaded.md @@ -108,8 +108,8 @@ This analytic identifies XMRIG coinminer driver installation on the system. The #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **xmrig_driver_loaded_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md index 2991a72568..7832bc24d5 100644 --- a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md +++ b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md @@ -107,8 +107,8 @@ The following analytic identifies the use of `wmic.exe` using `delete` to remove #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-05-06-download_files_using_telegram.md b/docs/_posts/2021-05-06-download_files_using_telegram.md index 43eaa37a0b..e75d99cd23 100644 --- a/docs/_posts/2021-05-06-download_files_using_telegram.md +++ b/docs/_posts/2021-05-06-download_files_using_telegram.md @@ -101,8 +101,8 @@ The following analytic will identify a suspicious download by the Telegram appli #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **download_files_using_telegram_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md index 2283e7d33e..04879af5f4 100644 --- a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md +++ b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md @@ -101,8 +101,8 @@ This analytic will detect a suspicious Telegram process enumerating all network #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **enumerate_users_local_group_using_telegram_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md b/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md index cdb6bd5506..b1bcc55565 100644 --- a/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md +++ b/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md @@ -101,8 +101,8 @@ This following analytic detects PowerShell command to delete shadow copy using t #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **delete_shadowcopy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md index 64ff8b9995..869bea7299 100644 --- a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md +++ b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md @@ -106,8 +106,8 @@ This analytic detects a potential process using COM Object like CMLUA or CMSTPLU #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **cmlua_or_cmstplua_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md b/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md index f8d18f858e..9f0639ec6f 100644 --- a/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md +++ b/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md @@ -106,8 +106,8 @@ The following analytic identifies suspicious PowerShell command to allow inbound #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **allow_inbound_traffic_in_firewall_rule_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-19-mailsniper_invoke_functions.md b/docs/_posts/2021-05-19-mailsniper_invoke_functions.md index e5e1267fc9..4ea231a206 100644 --- a/docs/_posts/2021-05-19-mailsniper_invoke_functions.md +++ b/docs/_posts/2021-05-19-mailsniper_invoke_functions.md @@ -106,8 +106,8 @@ This search is to detect known mailsniper.ps1 functions executed in a machine. T #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **mailsniper_invoke_functions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md index c32f863108..09d1324b0b 100644 --- a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md +++ b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md @@ -119,8 +119,8 @@ This analytic identifies a common behavior by Cobalt Strike and other frameworks #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-06-02-modification_of_wallpaper.md b/docs/_posts/2021-06-02-modification_of_wallpaper.md index bb4baa84c7..5286c0105c 100644 --- a/docs/_posts/2021-06-02-modification_of_wallpaper.md +++ b/docs/_posts/2021-06-02-modification_of_wallpaper.md @@ -101,8 +101,8 @@ This analytic identifies suspicious modification of registry to deface or change #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **modification_of_wallpaper_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md index aa6d560171..f095875738 100644 --- a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md +++ b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md @@ -106,8 +106,8 @@ this search is designed to detect potential malicious process loading COM object #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **wbemprox_com_object_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md index 3c01acc3b9..e87879902a 100644 --- a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md +++ b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md @@ -101,8 +101,8 @@ This search detects a suspicioous termination of known services killed by ransom #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **known_services_killed_by_ransomware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md b/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md index 98ba72fb42..9ee956342a 100644 --- a/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md +++ b/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md @@ -114,8 +114,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_fileless_process_injection_via_getprocaddress_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md b/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md index c538fe2b26..0dd71e0692 100644 --- a/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md +++ b/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md @@ -113,8 +113,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_fileless_script_contains_base64_encoded_content_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md b/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md index fa15056f8b..937137c5c5 100644 --- a/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md +++ b/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md @@ -107,8 +107,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **detect_empire_with_powershell_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md b/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md index b7dc1c284f..9cdd30b4b4 100644 --- a/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md +++ b/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md @@ -102,8 +102,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **detect_mimikatz_with_powershell_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md index 793f8550d3..6951933b36 100644 --- a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md +++ b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md @@ -112,8 +112,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **unloading_amsi_via_reflection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md b/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md index 6c6cf0c524..3d95cf36ad 100644 --- a/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md +++ b/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md @@ -105,8 +105,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_creating_thread_mutex_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-powershell_domain_enumeration.md b/docs/_posts/2021-06-10-powershell_domain_enumeration.md index ddf93250e3..0757c652df 100644 --- a/docs/_posts/2021-06-10-powershell_domain_enumeration.md +++ b/docs/_posts/2021-06-10-powershell_domain_enumeration.md @@ -107,8 +107,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_domain_enumeration_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md b/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md index 22736ee8b4..667a553d34 100644 --- a/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md +++ b/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md @@ -107,8 +107,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_loading_dotnet_into_memory_via_reflection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md b/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md index 4653bf74ad..b71eb3e434 100644 --- a/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md +++ b/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md @@ -105,8 +105,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_processing_stream_of_data_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-recon_using_wmi_class.md b/docs/_posts/2021-06-10-recon_using_wmi_class.md index 4c8d730be6..d8de0164f3 100644 --- a/docs/_posts/2021-06-10-recon_using_wmi_class.md +++ b/docs/_posts/2021-06-10-recon_using_wmi_class.md @@ -100,8 +100,8 @@ The following analytic identifies suspicious PowerShell via EventCode 4104, wher #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **recon_using_wmi_class_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md b/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md index 35dc4c2b53..6e8073b494 100644 --- a/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md +++ b/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md @@ -100,8 +100,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **wmi_recon_running_process_or_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md index 72713207b3..d2bde70c61 100644 --- a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md +++ b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md @@ -112,8 +112,8 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_wmi_event_subscription_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md index f638d3f37f..ff2ea0cea2 100644 --- a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md +++ b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md @@ -115,8 +115,8 @@ The following analytic utilizes Windows Event ID 1100 to identify when Windows e #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **suspicious_event_log_service_behavior_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md b/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md index 85426be232..937bb94c5e 100644 --- a/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md +++ b/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md @@ -106,8 +106,8 @@ This search is to detect a suspicious enabling of smb1protocol through "powershe #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_enable_smb1protocol_feature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md index eb65981ea1..18aeadf0f2 100644 --- a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md +++ b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md @@ -107,8 +107,8 @@ This search is to detect a suspicious commandline designed to delete files or di #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md index bfc3e0d66e..8c3d97cd67 100644 --- a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md +++ b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md @@ -107,8 +107,8 @@ This search is to detect a suspicious modification of firewall to allow file and #### Macros The SPL above uses the following Macros: -* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md index f6419290a6..901c9a4e51 100644 --- a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md +++ b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md @@ -107,8 +107,8 @@ This search is to detect a suspicious modification to the firewall to allow netw #### Macros The SPL above uses the following Macros: -* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md index 849bccd29b..f3fa23324d 100644 --- a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md +++ b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md @@ -111,8 +111,8 @@ This search is to detect a suspicious excessive usage of sc.exe in a host machin #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **excessive_usage_of_sc_service_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md index cb2ac3bed0..c3db511f1e 100644 --- a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md +++ b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md @@ -105,7 +105,7 @@ This search is to detect suspicious loading of dll in specific path relative to ``` `sysmon` EventCode=7 Image ="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*" ImageLoaded = "*.dll" -| stats dc(ImageLoaded) as countImgloaded values(ImageLoaded) as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer process_id EventCode +| stats dc(ImageLoaded) as countImgloaded values(ImageLoaded) as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer ProcessId EventCode | where countImgloaded >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -114,8 +114,8 @@ This search is to detect suspicious loading of dll in specific path relative to #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **spoolsv_suspicious_loaded_modules_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -165,4 +165,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith -[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml) \| *version*: **1** \ No newline at end of file +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/spoolsv_suspicious_loaded_modules.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md index a22067412c..406084fcfc 100644 --- a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md +++ b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md @@ -106,8 +106,8 @@ This analytic identifies a suspicious behavior related to PrintNightmare, or CVE #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **spoolsv_suspicious_process_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md index 72cefff943..20678262d5 100644 --- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md +++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md @@ -113,8 +113,8 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **spoolsv_writing_a_dll_-_sysmon_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md index c9f070f3ec..6f9d39c5bf 100644 --- a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md +++ b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md @@ -108,8 +108,8 @@ This search is to detect a suspicious loaded unsigned dll by MMC.exe application #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **uac_bypass_mmc_load_unsigned_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md index 6897b647f6..251e2c5e25 100644 --- a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md +++ b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md @@ -107,9 +107,9 @@ This search is to detect a suspicious mshta.exe process that spawn rundll32 or r #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md index 1a8abd0c7d..2d76b31dca 100644 --- a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md +++ b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md @@ -107,8 +107,8 @@ this search is to detect a suspicious office product process that spawn cmd chil #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md b/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md index 1f08a24b4d..ba50bfd6fb 100644 --- a/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md +++ b/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md @@ -112,8 +112,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **detect_copy_of_shadowcopy_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md index 7ee60a9e83..ef3e261bdf 100644 --- a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md +++ b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md @@ -102,8 +102,8 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **rundll32_createremotethread_in_browser_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md index 2fee621286..2612bc03e8 100644 --- a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md +++ b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md @@ -106,8 +106,8 @@ This search is to detect a suspicious rundll32 process that drops executable (.e #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **rundll32_process_creating_exe_dll_files_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md index 27cbb5c585..a70a85e8c3 100644 --- a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md +++ b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md @@ -109,8 +109,8 @@ The following analytic identifies Regsvr32.exe utilizing the silent switch to lo #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md index fdf4ec8c06..57dd88fc58 100644 --- a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md +++ b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md @@ -102,8 +102,8 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **rundll32_create_remote_thread_to_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-30-drop_icedid_license_dat.md b/docs/_posts/2021-07-30-drop_icedid_license_dat.md index 35acb6bef9..229fecc735 100644 --- a/docs/_posts/2021-07-30-drop_icedid_license_dat.md +++ b/docs/_posts/2021-07-30-drop_icedid_license_dat.md @@ -106,8 +106,8 @@ This search is to detect dropping a suspicious file named as "license.dat" in %a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **drop_icedid_license_dat_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md index 7ee2b55ee4..1f2de9c0c4 100644 --- a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md +++ b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md @@ -106,8 +106,8 @@ This search is to detect a suspicious file creation namely passff.tar and cookie #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **icedid_exfiltrated_archived_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md index ae7b48391d..d478b8a1dc 100644 --- a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md +++ b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md @@ -107,8 +107,8 @@ this detection was designed to identifies suspicious spawned process of known MS #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md index e3ec1efb85..24da952f26 100644 --- a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md +++ b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md @@ -101,8 +101,8 @@ This search is to detect a suspicious file creation of sqlite3.dll in %temp% fol #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **sqlite_module_in_temp_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md index bf0db94672..2d8501f31d 100644 --- a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md +++ b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md @@ -102,8 +102,8 @@ This search is to detect suspicious process injection in command shell. This tec #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **create_remote_thread_in_shell_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md index 65a9387f53..3fb4417f2a 100644 --- a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md +++ b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md @@ -106,8 +106,8 @@ This search is to detect a possible uac bypass using the colorui.dll COM Object. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **uac_bypass_with_colorui_com_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-18-esentutl_sam_copy.md b/docs/_posts/2021-08-18-esentutl_sam_copy.md index 0be02ff4ba..fcb09a3843 100644 --- a/docs/_posts/2021-08-18-esentutl_sam_copy.md +++ b/docs/_posts/2021-08-18-esentutl_sam_copy.md @@ -108,8 +108,8 @@ The following analytic identifies the process - `esentutl.exe` - being used to c #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_esentutl](https://github.com/splunk/security_content/blob/develop/macros/process_esentutl.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **esentutl_sam_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md index 5a3ba78959..c53734cb79 100644 --- a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md +++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md @@ -115,8 +115,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### Macros The SPL above uses the following Macros: -* [aws_ecr_users](https://github.com/splunk/security_content/blob/develop/macros/aws_ecr_users.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [aws_ecr_users](https://github.com/splunk/security_content/blob/develop/macros/aws_ecr_users.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: diff --git a/docs/_posts/2021-08-20-github_commit_changes_in_master.md b/docs/_posts/2021-08-20-github_commit_changes_in_master.md index b176886222..0db42eec42 100644 --- a/docs/_posts/2021-08-20-github_commit_changes_in_master.md +++ b/docs/_posts/2021-08-20-github_commit_changes_in_master.md @@ -101,8 +101,8 @@ This search is to detect a pushed or commit to master or main branch. This is to #### Macros The SPL above uses the following Macros: -* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) > :information_source: > **github_commit_changes_in_master_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md index ac0fc91be6..d467a3d42a 100644 --- a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md +++ b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md @@ -113,8 +113,8 @@ This search uses the Kubernetes logs from a nginx ingress controller to detect l #### Macros The SPL above uses the following Macros: -* [kubernetes_container_controller](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_container_controller.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [kubernetes_container_controller](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_container_controller.yml) > :information_source: > **kubernetes_nginx_ingress_lfi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md index 6a544a3ab2..5154dc678b 100644 --- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md +++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getwmiobject_user_account_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md index ab149bc49c..d62060e513 100644 --- a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md +++ b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md @@ -113,8 +113,8 @@ This search uses the Kubernetes logs from a nginx ingress controller to detect r #### Macros The SPL above uses the following Macros: -* [kubernetes_container_controller](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_container_controller.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [kubernetes_container_controller](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_container_controller.yml) > :information_source: > **kubernetes_nginx_ingress_rfi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md index ea9a9b6194..5f2ea3159e 100644 --- a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md +++ b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **adsisearcher_account_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md index 05ece5ca7d..73f076029d 100644 --- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md @@ -102,8 +102,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **get-domaintrust_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md b/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md index 2885ec9bca..983227c015 100644 --- a/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **get_aduser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md index c090f4f54a..85d80cf3e0 100644 --- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getwmiobject_ds_user_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md b/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md index 56e7aa0105..1d73972dff 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **domain_group_discovery_with_adsisearcher_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md index 95bcfb93d3..98c721908f 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **elevated_group_discovery_with_powerview_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md index 52ea5b8660..1459f1acb7 100644 --- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md +++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getwmiobject_ds_group_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md index ff79a04102..3d7f3879c5 100644 --- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md @@ -100,8 +100,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **get_aduserresultantpasswordpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md index ee64ac4113..f458409ba1 100644 --- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md @@ -100,8 +100,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **get_domainpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md b/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md index 545ab393fc..7b0607e962 100644 --- a/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getdomaingroup_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md index a4109f88e7..27495bc909 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md +++ b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md @@ -107,8 +107,8 @@ Review the source attempting to perform this activity against your environment. #### Macros The SPL above uses the following Macros: -* [exchange](https://github.com/splunk/security_content/blob/develop/macros/exchange.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [exchange](https://github.com/splunk/security_content/blob/develop/macros/exchange.yml) > :information_source: > **exchange_powershell_abuse_via_ssrf_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md index 38f8098ad8..4ed53fb857 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md +++ b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md @@ -111,8 +111,8 @@ Module - New-managementroleassignment can assign a management role to a manageme #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **exchange_powershell_module_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md index 74fd24e098..7ae0dd38c1 100644 --- a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md +++ b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md @@ -108,8 +108,8 @@ During triage, review parallel security events to identify further suspicious ac #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **petitpotam_network_share_access_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md index 097e4595bc..639b6ff4aa 100644 --- a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md +++ b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md @@ -105,8 +105,8 @@ The following analytic identifes Event Code 4768, A `Kerberos authentication tic #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **petitpotam_suspicious_kerberos_tgt_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md index 9f6011c46d..b9e7f01b8a 100644 --- a/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getadcomputer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md index 9ef16fa75a..9170f1ee06 100644 --- a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getwmiobject_ds_computer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-github_commit_in_develop.md b/docs/_posts/2021-09-01-github_commit_in_develop.md index 2eef99dca3..e2886e38e9 100644 --- a/docs/_posts/2021-09-01-github_commit_in_develop.md +++ b/docs/_posts/2021-09-01-github_commit_in_develop.md @@ -101,8 +101,8 @@ This search is to detect a pushed or commit to develop branch. This is to avoid #### Macros The SPL above uses the following Macros: -* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) > :information_source: > **github_commit_in_develop_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-github_dependabot_alert.md b/docs/_posts/2021-09-01-github_dependabot_alert.md index fd2a212384..8e071247fe 100644 --- a/docs/_posts/2021-09-01-github_dependabot_alert.md +++ b/docs/_posts/2021-09-01-github_dependabot_alert.md @@ -113,8 +113,8 @@ This search looks for Dependabot Alerts in Github logs. #### Macros The SPL above uses the following Macros: -* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) > :information_source: > **github_dependabot_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md index 986599f6e5..2d64e0e59c 100644 --- a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md +++ b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md @@ -114,9 +114,9 @@ This search looks for Pull Request from unknown user. #### Macros The SPL above uses the following Macros: +* [github_known_users](https://github.com/splunk/security_content/blob/develop/macros/github_known_users.yml) * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [github_known_users](https://github.com/splunk/security_content/blob/develop/macros/github_known_users.yml) > :information_source: > **github_pull_request_from_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md b/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md index f62c1c6ce5..4f4365757b 100644 --- a/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md +++ b/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **remote_system_discovery_with_adsisearcher_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md index 6004b1416c..daeb19634d 100644 --- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md @@ -102,8 +102,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **get-foresttrust_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md b/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md index f35dfdad93..e820fccf06 100644 --- a/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getdomaincomputer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md b/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md index 6438259673..97f3ed9faf 100644 --- a/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getdomaincontroller_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md index 5f1e7fe3f7..64cb7c7e3c 100644 --- a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md +++ b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md @@ -106,8 +106,8 @@ This analytic is to detect an application try to connect and create ADSI Object #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **schcache_change_by_app_connect_and_create_adsi_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-09-extraction_of_registry_hives.md b/docs/_posts/2021-09-09-extraction_of_registry_hives.md index de39548248..906af392f7 100644 --- a/docs/_posts/2021-09-09-extraction_of_registry_hives.md +++ b/docs/_posts/2021-09-09-extraction_of_registry_hives.md @@ -107,8 +107,8 @@ The following analytic identifies the use of `reg.exe` exporting Windows Registr #### Macros The SPL above uses the following Macros: -* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md b/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md index 9cbc7d7180..0d5361e0f4 100644 --- a/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md +++ b/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getnettcpconnection_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md index 3b0d396361..397b2fde50 100644 --- a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md +++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md @@ -106,8 +106,8 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **ms_scripting_process_loading_ldap_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md index d0dc7976de..9b34319ea7 100644 --- a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md +++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md @@ -106,8 +106,8 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **ms_scripting_process_loading_wmi_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md index d16a8f74c7..34a46ae1ab 100644 --- a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md +++ b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md @@ -102,8 +102,8 @@ This search is to detect a suspicious wmic.exe process or renamed wmic process t #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md index 96189c8f79..406541d7d5 100644 --- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md +++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md @@ -107,8 +107,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_get_localgroup_discovery_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md index 9f48a1bb5b..d8ee054155 100644 --- a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md +++ b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md @@ -106,8 +106,8 @@ This search is to detect an anomaly event of non-chrome process accessing the fi #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **non_chrome_process_accessing_chrome_default_dir_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md index eb47910925..a2d1d3b7c1 100644 --- a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md +++ b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md @@ -106,8 +106,8 @@ This search is to detect an anomaly event of non-firefox process accessing the f #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **non_firefox_process_access_firefox_profile_dir_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md index 1ce1a64c89..54672494fe 100644 --- a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md +++ b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md @@ -116,8 +116,8 @@ Attempt To Add Certificate To Untrusted Store #### Macros The SPL above uses the following Macros: -* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md index 8ee59db57a..9aa29771a0 100644 --- a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md +++ b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md @@ -113,9 +113,9 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th #### Macros The SPL above uses the following Macros: -* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md index d5cdc78b58..d5760a955e 100644 --- a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md +++ b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md @@ -112,8 +112,8 @@ This search detects the use of wmic and Powershell to create a shadow copy. #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) diff --git a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md index dcf5dcfcc6..6b569688ce 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md @@ -112,8 +112,8 @@ This search detects credential dumping using copy command from a shadow copy. #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md index 07f3c1ee10..21b44df3dd 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md @@ -112,8 +112,8 @@ This search detects the creation of a symlink to a shadow copy. #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md index 2b0c206d92..2301b8a300 100644 --- a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md @@ -112,8 +112,8 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: -* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md index 7adebd9f38..879ffee11e 100644 --- a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md +++ b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md @@ -112,8 +112,8 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: -* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md index eacfc71a0e..917308ab5f 100644 --- a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md +++ b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md @@ -112,8 +112,8 @@ The following analytic identifies "mshta.exe" execution with inline protocol han #### Macros The SPL above uses the following Macros: -* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md index 6e43b419ee..6d3b9fd3f3 100644 --- a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md @@ -112,8 +112,8 @@ This analytic identifies when Microsoft HTML Application Host (mshta.exe) utilit #### Macros The SPL above uses the following Macros: -* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md index 1dea81ca3d..792de3fc4f 100644 --- a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md +++ b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md @@ -112,8 +112,8 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla #### Macros The SPL above uses the following Macros: -* [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md index cbd7f74e6d..1a41c5629e 100644 --- a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md +++ b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md @@ -114,8 +114,8 @@ During triage, confirm this is procdump.exe executing. If it is the first time a #### Macros The SPL above uses the following Macros: -* [process_procdump](https://github.com/splunk/security_content/blob/develop/macros/process_procdump.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_procdump](https://github.com/splunk/security_content/blob/develop/macros/process_procdump.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md index 8bbbca5fdd..df514a0d38 100644 --- a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md +++ b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md @@ -107,8 +107,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-office_product_spawning_wmic.md b/docs/_posts/2021-09-16-office_product_spawning_wmic.md index 11ee174959..82fd721322 100644 --- a/docs/_posts/2021-09-16-office_product_spawning_wmic.md +++ b/docs/_posts/2021-09-16-office_product_spawning_wmic.md @@ -107,8 +107,8 @@ The following detection identifies the latest behavior utilized by Ursnif malwar #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-16-processes_launching_netsh.md b/docs/_posts/2021-09-16-processes_launching_netsh.md index 25121ac6e9..0969ffa570 100644 --- a/docs/_posts/2021-09-16-processes_launching_netsh.md +++ b/docs/_posts/2021-09-16-processes_launching_netsh.md @@ -112,8 +112,8 @@ This search looks for processes launching netsh.exe. Netsh is a command-line scr #### Macros The SPL above uses the following Macros: -* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-29-verclsid_clsid_execution.md b/docs/_posts/2021-09-29-verclsid_clsid_execution.md index 5ed0df7318..81c53e695d 100644 --- a/docs/_posts/2021-09-29-verclsid_clsid_execution.md +++ b/docs/_posts/2021-09-29-verclsid_clsid_execution.md @@ -107,8 +107,8 @@ This analytic is to detect a possible abuse of verclsid to execute malicious fil #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_verclsid](https://github.com/splunk/security_content/blob/develop/macros/process_verclsid.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md index 9014907709..9a0aea5cea 100644 --- a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md +++ b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md @@ -109,8 +109,8 @@ This analytic is to detect a loading of dll using regsvr32 application with sile #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md index c6a43b9ce7..1d8f99d51b 100644 --- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md +++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md @@ -104,8 +104,8 @@ During triage, review parallel processes for further suspicious activity. #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **serviceprincipalnames_discovery_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md index 14fed43740..7a1f5eedc5 100644 --- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md +++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md @@ -109,8 +109,8 @@ During triage, review parallel processes for further suspicious activity. #### Macros The SPL above uses the following Macros: -* [process_setspn](https://github.com/splunk/security_content/blob/develop/macros/process_setspn.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_setspn](https://github.com/splunk/security_content/blob/develop/macros/process_setspn.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md b/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md index 8b58d45823..d893b1bbd3 100644 --- a/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md +++ b/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md @@ -104,8 +104,8 @@ The following hunting analytic assists with identifying suspicious tasks that ha #### Macros The SPL above uses the following Macros: -* [wineventlog_task_scheduler](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_task_scheduler.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_task_scheduler](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_task_scheduler.yml) > :information_source: > **winevent_windows_task_scheduler_event_action_started_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md index 284af4d9fc..83bfac410c 100644 --- a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md +++ b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md @@ -102,8 +102,8 @@ The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible St #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md index e393521d7a..52abb47d1e 100644 --- a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md +++ b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md @@ -107,8 +107,8 @@ this analytic is to detect a suspicious compile before delivery approach of .net #### Macros The SPL above uses the following Macros: -* [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md index dfdeda3039..1f87ace6f7 100644 --- a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md +++ b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md @@ -107,8 +107,8 @@ This analytic look for a spawned process of route.exe windows application. Adver #### Macros The SPL above uses the following Macros: -* [process_route](https://github.com/splunk/security_content/blob/develop/macros/process_route.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_route](https://github.com/splunk/security_content/blob/develop/macros/process_route.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md index 622f31b0c1..41a3561c9d 100644 --- a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md +++ b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md @@ -110,8 +110,8 @@ This analytic identifies wmic.exe being launched with parameters to spawn a proc #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-11-12-runas_execution_in_commandline.md b/docs/_posts/2021-11-12-runas_execution_in_commandline.md index 44ab86c0bc..8a8ef5efad 100644 --- a/docs/_posts/2021-11-12-runas_execution_in_commandline.md +++ b/docs/_posts/2021-11-12-runas_execution_in_commandline.md @@ -109,8 +109,8 @@ This analytic look for a spawned runas.exe process with a administrator user opt #### Macros The SPL above uses the following Macros: -* [process_runas](https://github.com/splunk/security_content/blob/develop/macros/process_runas.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_runas](https://github.com/splunk/security_content/blob/develop/macros/process_runas.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md index 55bc046bbd..215c786252 100644 --- a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md +++ b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md @@ -111,8 +111,8 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md index c2736e0ce1..dfc676e66c 100644 --- a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md +++ b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md @@ -110,8 +110,8 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md index b8856a3372..7b124d8434 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md @@ -99,8 +99,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **remote_process_instantiation_via_wmi_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md index 61fc5ef9a0..04a37eba8b 100644 --- a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md +++ b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md @@ -105,8 +105,8 @@ The following analytic identifies executable files (.exe or .dll) being written #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **executable_file_written_in_administrative_smb_share_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md index ab844da06b..1c834b88c8 100644 --- a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md +++ b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md @@ -108,8 +108,8 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **loading_of_dynwrapx_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md index f2e189df34..8a5c2e0826 100644 --- a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md +++ b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md @@ -103,8 +103,8 @@ This analytic is to detect a suspicious dxdiag.exe process command-line executio #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_dxdiag](https://github.com/splunk/security_content/blob/develop/macros/process_dxdiag.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **system_info_gathering_using_dxdiag_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md index 44e6b12703..b547469c0b 100644 --- a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md +++ b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md @@ -105,8 +105,8 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **windows_service_created_with_suspicious_service_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md index 1c40def6e4..ddf621fad7 100644 --- a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md +++ b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md @@ -107,8 +107,8 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **windows_service_created_within_public_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md b/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md index 6c2914b698..9d367f82a9 100644 --- a/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md +++ b/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md @@ -106,8 +106,8 @@ This analytic will detect a suspicious process commandline related to windows de #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_windows_defender_exclusion_commands_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md index bb1802f83a..625fff80eb 100644 --- a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md +++ b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md @@ -103,8 +103,8 @@ This analytic identifies commonly used command-line arguments used by `rclone.ex #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_rclone](https://github.com/splunk/security_content/blob/develop/macros/process_rclone.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **detect_rclone_command-line_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md index d94c2cff62..180db1a279 100644 --- a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md +++ b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md @@ -119,8 +119,8 @@ In addition, `msi.dll` has been abused in DLL side-loading attacks by being load #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **msi_module_loaded_by_non-system_binary_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-13-linux_java_spawning_shell.md b/docs/_posts/2021-12-13-linux_java_spawning_shell.md index 5d26459021..9c3749457a 100644 --- a/docs/_posts/2021-12-13-linux_java_spawning_shell.md +++ b/docs/_posts/2021-12-13-linux_java_spawning_shell.md @@ -107,8 +107,8 @@ The following analytic identifies the process name of Java, Apache, or Tomcat sp #### Macros The SPL above uses the following Macros: -* [linux_shells](https://github.com/splunk/security_content/blob/develop/macros/linux_shells.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [linux_shells](https://github.com/splunk/security_content/blob/develop/macros/linux_shells.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md index 58ff38a98a..ee9b513261 100644 --- a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md +++ b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md @@ -109,8 +109,8 @@ The following hunting analytic identifies all processes requesting access into L #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_hunting_system_account_targeting_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md index c48ad067c4..cc2eb7766c 100644 --- a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md +++ b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md @@ -109,8 +109,8 @@ The following analytic identifies non SYSTEM accounts requesting access to lsass #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_non-system_account_targeting_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md index 65de741ab3..b0cb5436ae 100644 --- a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md +++ b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md @@ -112,8 +112,8 @@ The following analytic identifies command-line arguments where `cmd.exe /c` is u #### Macros The SPL above uses the following Macros: -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md b/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md index 79d72396a3..a5c900d7f4 100644 --- a/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md +++ b/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md @@ -112,8 +112,8 @@ This analytic will identify a suspicious PowerShell command used to delete the W #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_remove_windows_defender_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md index b4a40a14d5..02fb93e350 100644 --- a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md +++ b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md @@ -106,8 +106,8 @@ This analytic detects a suspicious process making a DNS query via known, abused #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_process_dns_query_known_abuse_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md index 1ce9a54f4f..d77807e154 100644 --- a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md +++ b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md @@ -118,8 +118,8 @@ The following analytic identifies native .net binaries within the Windows operat #### Macros The SPL above uses the following Macros: -* [is_net_windows_file](https://github.com/splunk/security_content/blob/develop/macros/is_net_windows_file.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [is_net_windows_file](https://github.com/splunk/security_content/blob/develop/macros/is_net_windows_file.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md index 14da8b3f81..58e4d0e11d 100644 --- a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md +++ b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md @@ -117,8 +117,8 @@ The following analytic identifies the Windows binary InstallUtil.exe running fro #### Macros The SPL above uses the following Macros: -* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md index f0282edf5f..837ffae589 100644 --- a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md +++ b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md @@ -108,8 +108,8 @@ This analytic will identify excessive file deletion events in the Windows Defend #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **excessive_file_deletion_in_windefender_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-20-ping_sleep_batch_command.md b/docs/_posts/2022-01-20-ping_sleep_batch_command.md index 24d910afbf..cc3548f17a 100644 --- a/docs/_posts/2022-01-20-ping_sleep_batch_command.md +++ b/docs/_posts/2022-01-20-ping_sleep_batch_command.md @@ -115,8 +115,8 @@ This analytic will identify the possible execution of ping sleep batch commands. #### Macros The SPL above uses the following Macros: -* [process_ping](https://github.com/splunk/security_content/blob/develop/macros/process_ping.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_ping](https://github.com/splunk/security_content/blob/develop/macros/process_ping.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md index 5a80b1df2e..c8dcd7fcfc 100644 --- a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md +++ b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md @@ -103,8 +103,8 @@ The following hunting analytic assists with identifying the proces execution of #### Macros The SPL above uses the following Macros: -* [is_nirsoft_software](https://github.com/splunk/security_content/blob/develop/macros/is_nirsoft_software.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [is_nirsoft_software](https://github.com/splunk/security_content/blob/develop/macros/is_nirsoft_software.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md index e89c702ca3..7799ba7e41 100644 --- a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md +++ b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md @@ -113,8 +113,8 @@ The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_possible_credential_dumping_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md index 5baa3b5d90..d092e269dc 100644 --- a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md +++ b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md @@ -102,8 +102,8 @@ Certutil.exe may download a file from a remote destination using `-urlcache`. Th #### Macros The SPL above uses the following Macros: -* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md index 12ab6d2b16..b4a4ddd812 100644 --- a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md +++ b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md @@ -102,8 +102,8 @@ Certutil.exe may download a file from a remote destination using `-VerifyCtl`. T #### Macros The SPL above uses the following Macros: -* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md index df18dc6ceb..7e85cb86f9 100644 --- a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md +++ b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md @@ -108,8 +108,8 @@ The following analytic looks for a process accessing the winlogon.exe system pro #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **rubeus_kerberos_ticket_exports_through_winlogon_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md index 7722585244..be25d49dfa 100644 --- a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md +++ b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md @@ -111,8 +111,8 @@ The following analytic identifies Schtasks.exe creating a new task to start and #### Macros The SPL above uses the following Macros: -* [process_schtasks](https://github.com/splunk/security_content/blob/develop/macros/process_schtasks.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_schtasks](https://github.com/splunk/security_content/blob/develop/macros/process_schtasks.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md b/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md index 50528a4b61..8ebe56389a 100644 --- a/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md +++ b/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md @@ -110,8 +110,8 @@ The following analytic leverages Kerberos Event 4769, A Kerberos service ticket #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **kerberoasting_spn_request_with_rc4_encryption_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md index 1ca1eaee9e..4417a3dfb8 100644 --- a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md +++ b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md @@ -106,8 +106,8 @@ DiskShadow.exe is a Microsoft Signed binary present on Windows Server. It has a #### Macros The SPL above uses the following Macros: -* [process_diskshadow](https://github.com/splunk/security_content/blob/develop/macros/process_diskshadow.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_diskshadow](https://github.com/splunk/security_content/blob/develop/macros/process_diskshadow.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md index 39f2b80d72..12bd46fc7a 100644 --- a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md +++ b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md @@ -112,8 +112,8 @@ This analytic is to look for suspicious raw access read to drive where the maste #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_raw_access_to_master_boot_record_drive_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md index 51d1e73d56..b8e76acd2d 100644 --- a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md +++ b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md @@ -111,8 +111,8 @@ The following analytic identifies regasm.exe with a network connection to a publ #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_regasm_with_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md index 663285a202..6c6367c37c 100644 --- a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md +++ b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md @@ -111,8 +111,8 @@ The following analytic identifies Regsvcs.exe with a network connection to a pub #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **detect_regsvcs_with_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md b/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md index 3c247d1e0f..22d141bf26 100644 --- a/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md +++ b/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **disabled_kerberos_pre-authentication_discovery_with_powerview_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md index fe11db54f8..d2e44a1965 100644 --- a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md +++ b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md @@ -103,8 +103,8 @@ This detection is to identify a suspicious process that tries to delete the proc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **process_deleting_its_process_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-rundll32_dnsquery.md b/docs/_posts/2022-02-18-rundll32_dnsquery.md index 75b9319c65..d2f3c5bda6 100644 --- a/docs/_posts/2022-02-18-rundll32_dnsquery.md +++ b/docs/_posts/2022-02-18-rundll32_dnsquery.md @@ -106,8 +106,8 @@ This search is to detect a suspicious rundll32.exe process having a http connect #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **rundll32_dnsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md b/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md index 2b99704f67..60219a7987 100644 --- a/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md +++ b/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md @@ -104,8 +104,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **disabled_kerberos_pre-authentication_discovery_with_get-aduser_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md index 96eedbf53b..65ca269f9e 100644 --- a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md +++ b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md @@ -108,8 +108,8 @@ This analytic is to look for wmi commandlines to execute or create process. This #### Macros The SPL above uses the following Macros: -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md b/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md index 0fa7e197b5..46b18ec802 100644 --- a/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md +++ b/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md @@ -113,8 +113,8 @@ This analytic will identify suspicious excessive number of system events of serv #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **windows_excessive_disabled_services_event_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md index 8585a4f9e0..539abbfa7f 100644 --- a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md +++ b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md @@ -112,8 +112,8 @@ This analytic is to look for suspicious raw access read to device disk partition #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_raw_access_to_disk_volume_partition_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-04-macos_lolbin.md b/docs/_posts/2022-03-04-macos_lolbin.md index 2d6f2c8949..94c82a2200 100644 --- a/docs/_posts/2022-03-04-macos_lolbin.md +++ b/docs/_posts/2022-03-04-macos_lolbin.md @@ -115,8 +115,8 @@ Detect multiple executions of Living off the Land (LOLbin) binaries in a short p #### Macros The SPL above uses the following Macros: -* [osquery](https://github.com/splunk/security_content/blob/develop/macros/osquery.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [osquery](https://github.com/splunk/security_content/blob/develop/macros/osquery.yml) > :information_source: > **macos_lolbin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md index da8370397f..166aa0dead 100644 --- a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md @@ -113,8 +113,8 @@ The following analytic identifies regasm.exe with no command line arguments. Thi #### Macros The SPL above uses the following Macros: -* [process_regasm](https://github.com/splunk/security_content/blob/develop/macros/process_regasm.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_regasm](https://github.com/splunk/security_content/blob/develop/macros/process_regasm.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md index a4972826ff..2a33a397b7 100644 --- a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md @@ -113,8 +113,8 @@ The following analytic identifies regsvcs.exe with no command line arguments. Th #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_regsvcs](https://github.com/splunk/security_content/blob/develop/macros/process_regsvcs.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md b/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md index 54d27c0615..2b4295dc4f 100644 --- a/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md +++ b/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md @@ -105,8 +105,8 @@ The following analytic leverages Kerberos Event 4769, A Kerberos service ticket #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **kerberos_service_ticket_request_using_rc4_encryption_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md index c5fb8b3ffa..e9b550679a 100644 --- a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md @@ -105,8 +105,8 @@ The following analytic identifies DLLHost.exe with no command line arguments. It #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_dllhost](https://github.com/splunk/security_content/blob/develop/macros/process_dllhost.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **suspicious_dllhost_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md index 844a893453..f1df36b2c2 100644 --- a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md @@ -104,8 +104,8 @@ The following analytic identifies gpupdate.exe with no command line arguments. I #### Macros The SPL above uses the following Macros: -* [process_gpupdate](https://github.com/splunk/security_content/blob/develop/macros/process_gpupdate.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_gpupdate](https://github.com/splunk/security_content/blob/develop/macros/process_gpupdate.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md index f012129af1..a695f6e7b7 100644 --- a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md +++ b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md @@ -115,8 +115,8 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md index 5204d6ee21..e7ffbdeb55 100644 --- a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md +++ b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md @@ -116,8 +116,8 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-03-22-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2022-03-22-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md index 74f5f965b3..b92d9ede9a 100644 --- a/docs/_posts/2022-03-22-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md @@ -100,8 +100,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-get_domainuser_with_powershell_script_block.md b/docs/_posts/2022-03-22-get_domainuser_with_powershell_script_block.md index da5c5a0d7a..6537929b66 100644 --- a/docs/_posts/2022-03-22-get_domainuser_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-get_domainuser_with_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **get_domainuser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-get_wmiobject_group_discovery_with_script_block_logging.md b/docs/_posts/2022-03-22-get_wmiobject_group_discovery_with_script_block_logging.md index 3b0d03259d..bc2cd769f7 100644 --- a/docs/_posts/2022-03-22-get_wmiobject_group_discovery_with_script_block_logging.md +++ b/docs/_posts/2022-03-22-get_wmiobject_group_discovery_with_script_block_logging.md @@ -107,8 +107,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **get_wmiobject_group_discovery_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-getadgroup_with_powershell_script_block.md b/docs/_posts/2022-03-22-getadgroup_with_powershell_script_block.md index d41c63b039..2f98054adc 100644 --- a/docs/_posts/2022-03-22-getadgroup_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-getadgroup_with_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getadgroup_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-getcurrent_user_with_powershell_script_block.md b/docs/_posts/2022-03-22-getcurrent_user_with_powershell_script_block.md index 7360d8b806..a17ba7e26e 100644 --- a/docs/_posts/2022-03-22-getcurrent_user_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-getcurrent_user_with_powershell_script_block.md @@ -100,8 +100,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getcurrent_user_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md b/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md index fce94f7e8c..852b9be36e 100644 --- a/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md +++ b/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **getlocaluser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-interactive_session_on_remote_endpoint_with_powershell.md b/docs/_posts/2022-03-22-interactive_session_on_remote_endpoint_with_powershell.md index 794c52a432..6b739035e2 100644 --- a/docs/_posts/2022-03-22-interactive_session_on_remote_endpoint_with_powershell.md +++ b/docs/_posts/2022-03-22-interactive_session_on_remote_endpoint_with_powershell.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **interactive_session_on_remote_endpoint_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-kerberos_pre-authentication_flag_disabled_with_powershell.md b/docs/_posts/2022-03-22-kerberos_pre-authentication_flag_disabled_with_powershell.md index 1dbda3af81..ae8a733c0f 100644 --- a/docs/_posts/2022-03-22-kerberos_pre-authentication_flag_disabled_with_powershell.md +++ b/docs/_posts/2022-03-22-kerberos_pre-authentication_flag_disabled_with_powershell.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **kerberos_pre-authentication_flag_disabled_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-powershell_execute_com_object.md b/docs/_posts/2022-03-22-powershell_execute_com_object.md index 18ed9ef03a..812e504e80 100644 --- a/docs/_posts/2022-03-22-powershell_execute_com_object.md +++ b/docs/_posts/2022-03-22-powershell_execute_com_object.md @@ -108,8 +108,8 @@ This search is to detect a COM CLSID execution through powershell. This techniqu #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_execute_com_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md b/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md index 86b61d0868..f1e1f53671 100644 --- a/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md +++ b/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md @@ -105,8 +105,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **powershell_using_memory_as_backing_store_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md b/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md index 41ca8c1dbb..4b2f95e35b 100644 --- a/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md +++ b/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md @@ -100,8 +100,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **recon_avproduct_through_pwh_or_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-remote_process_instantiation_via_dcom_and_powershell_script_block.md b/docs/_posts/2022-03-22-remote_process_instantiation_via_dcom_and_powershell_script_block.md index 669000fd6a..d1a7fe8c0b 100644 --- a/docs/_posts/2022-03-22-remote_process_instantiation_via_dcom_and_powershell_script_block.md +++ b/docs/_posts/2022-03-22-remote_process_instantiation_via_dcom_and_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **remote_process_instantiation_via_dcom_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md b/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md index e285770d5e..b98a1b1544 100644 --- a/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md +++ b/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md @@ -105,8 +105,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **remote_process_instantiation_via_winrm_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-22-user_discovery_with_env_vars_powershell_script_block.md b/docs/_posts/2022-03-22-user_discovery_with_env_vars_powershell_script_block.md index c4cca2d7ac..b3eca55344 100644 --- a/docs/_posts/2022-03-22-user_discovery_with_env_vars_powershell_script_block.md +++ b/docs/_posts/2022-03-22-user_discovery_with_env_vars_powershell_script_block.md @@ -100,8 +100,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **user_discovery_with_env_vars_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-28-windows_get-adcomputer_unconstrained_delegation_discovery.md b/docs/_posts/2022-03-28-windows_get-adcomputer_unconstrained_delegation_discovery.md index 5b961d19a5..a3aedd0f60 100644 --- a/docs/_posts/2022-03-28-windows_get-adcomputer_unconstrained_delegation_discovery.md +++ b/docs/_posts/2022-03-28-windows_get-adcomputer_unconstrained_delegation_discovery.md @@ -106,8 +106,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **windows_get-adcomputer_unconstrained_delegation_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-28-windows_powerview_unconstrained_delegation_discovery.md b/docs/_posts/2022-03-28-windows_powerview_unconstrained_delegation_discovery.md index 3864819c70..bf1b12c71f 100644 --- a/docs/_posts/2022-03-28-windows_powerview_unconstrained_delegation_discovery.md +++ b/docs/_posts/2022-03-28-windows_powerview_unconstrained_delegation_discovery.md @@ -106,8 +106,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **windows_powerview_unconstrained_delegation_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-28-windows_terminating_lsass_process.md b/docs/_posts/2022-03-28-windows_terminating_lsass_process.md index 424eff1d3a..42ee8d7ce7 100644 --- a/docs/_posts/2022-03-28-windows_terminating_lsass_process.md +++ b/docs/_posts/2022-03-28-windows_terminating_lsass_process.md @@ -111,8 +111,8 @@ This analytic is to detect a suspicious process terminating Lsass process. Lsass #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_terminating_lsass_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md b/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md index f5be1cf051..c503983391 100644 --- a/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md +++ b/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md @@ -112,8 +112,8 @@ The following analytic assists with viewing all drivers being loaded by using Sy #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_drivers_loaded_by_signature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-31-windows_powerview_constrained_delegation_discovery.md b/docs/_posts/2022-03-31-windows_powerview_constrained_delegation_discovery.md index 7273292702..55aa0881cd 100644 --- a/docs/_posts/2022-03-31-windows_powerview_constrained_delegation_discovery.md +++ b/docs/_posts/2022-03-31-windows_powerview_constrained_delegation_discovery.md @@ -106,8 +106,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **windows_powerview_constrained_delegation_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md b/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md index 008e97ef0a..cb85c01f90 100644 --- a/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md +++ b/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md @@ -113,8 +113,8 @@ This search detects a disabled security workflow in GitHub Actions. An attacker #### Macros The SPL above uses the following Macros: -* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) > :information_source: > **github_actions_disable_security_workflow_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md b/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md index a49622fd78..e8bf097fdc 100644 --- a/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md +++ b/docs/_posts/2022-04-04-windows_driver_load_non-standard_path.md @@ -107,8 +107,8 @@ The following analytic uses Windows EventCode 7045 to identify new Kernel Mode D #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **windows_driver_load_non-standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-04-windows_event_for_service_disabled.md b/docs/_posts/2022-04-04-windows_event_for_service_disabled.md index ba8933f81a..5d7224b035 100644 --- a/docs/_posts/2022-04-04-windows_event_for_service_disabled.md +++ b/docs/_posts/2022-04-04-windows_event_for_service_disabled.md @@ -112,8 +112,8 @@ This analytic will identify suspicious system event of services that was modifie #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **windows_event_for_service_disabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md b/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md index 3ca6c97894..7192ee4b40 100644 --- a/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md +++ b/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md @@ -107,8 +107,8 @@ This search looks for the execution of `nltest.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [process_nltest](https://github.com/splunk/security_content/blob/develop/macros/process_nltest.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_nltest](https://github.com/splunk/security_content/blob/develop/macros/process_nltest.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md b/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md index b10e220124..7249744d4d 100644 --- a/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md +++ b/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md @@ -107,8 +107,8 @@ The following analytic is to look for known processes killed by industroyer2 mal #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_processes_killed_by_industroyer2_malware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-25-windows_linked_policies_in_adsi_discovery.md b/docs/_posts/2022-04-25-windows_linked_policies_in_adsi_discovery.md index 34af68501f..70fa0e4f3f 100644 --- a/docs/_posts/2022-04-25-windows_linked_policies_in_adsi_discovery.md +++ b/docs/_posts/2022-04-25-windows_linked_policies_in_adsi_discovery.md @@ -112,8 +112,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **windows_linked_policies_in_adsi_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-25-windows_root_domain_linked_policies_discovery.md b/docs/_posts/2022-04-25-windows_root_domain_linked_policies_discovery.md index db7c76d204..dc17c69bb6 100644 --- a/docs/_posts/2022-04-25-windows_root_domain_linked_policies_discovery.md +++ b/docs/_posts/2022-04-25-windows_root_domain_linked_policies_discovery.md @@ -112,8 +112,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) > :information_source: > **windows_root_domain_linked_policies_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md b/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md index 78de749e75..41c9d503c8 100644 --- a/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md +++ b/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md @@ -111,8 +111,8 @@ The following query utilizes Windows Security EventCode 4698, A scheduled task w #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **windows_hidden_schedule_task_settings_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md b/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md index 2c0de92432..0716084d03 100644 --- a/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md +++ b/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md @@ -107,8 +107,8 @@ The following analytic identifes a Computer Account creating a new Computer Acco #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **windows_computer_account_created_by_computer_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md b/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md index b5599f262c..6508556aaa 100644 --- a/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md +++ b/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md @@ -107,8 +107,8 @@ The following analytic identifies a ComputerAccount requesting a Kerberos Ticket #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **windows_computer_account_requesting_kerberos_ticket_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md b/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md index 8801b6f266..3d6baf3523 100644 --- a/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md +++ b/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md @@ -107,8 +107,8 @@ The following analytic identifies a local successful authentication event on a W #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **windows_kerberos_local_successful_logon_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-28-windows_computer_account_with_spn.md b/docs/_posts/2022-04-28-windows_computer_account_with_spn.md index 82539a9f8d..7c459b8206 100644 --- a/docs/_posts/2022-04-28-windows_computer_account_with_spn.md +++ b/docs/_posts/2022-04-28-windows_computer_account_with_spn.md @@ -109,8 +109,8 @@ The following analytic identifies two SPNs, HOST and RestrictedKrbHost, added us #### Macros The SPL above uses the following Macros: -* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) > :information_source: > **windows_computer_account_with_spn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md b/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md index 50bd382f02..197ec18a1a 100644 --- a/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md +++ b/docs/_posts/2022-05-02-windows_krbrelayup_service_creation.md @@ -108,8 +108,8 @@ The following analytic identifies the default service name created by KrbRelayUp #### Macros The SPL above uses the following Macros: -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) > :information_source: > **windows_krbrelayup_service_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md b/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md index 484b31b7fd..562a6beea7 100644 --- a/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md +++ b/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md @@ -108,8 +108,8 @@ Upon triage, review the process performing the named pipe. If it is explorer.exe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **cobalt_strike_named_pipes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-23-splunk_command_and_scripting_interpreter_risky_commands.md b/docs/_posts/2022-05-23-splunk_command_and_scripting_interpreter_risky_commands.md new file mode 100644 index 0000000000..a4e1df1b24 --- /dev/null +++ b/docs/_posts/2022-05-23-splunk_command_and_scripting_interpreter_risky_commands.md @@ -0,0 +1,181 @@ +--- +title: "Splunk Command and Scripting Interpreter Risky Commands" +excerpt: "Command and Scripting Interpreter +" +categories: + - Application +last_modified_at: 2022-05-23 +toc: true +toc_label: "" +tags: + - Command and Scripting Interpreter + - Execution + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - + - Splunk_Audit +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +The Splunk platform contains built-in search processing language (SPL) safeguards to warn you when you are about to unknowingly run a search that contains commands that might be a security risk. This warning appears when you click a link or type a URL that loads a search that contains risky commands. The warning does not appear when you create ad hoc searches. This warning alerts you to the possibility of unauthorized actions by a malicious user. Unauthorized actions include - Copying or transferring data (data exfiltration), Deleting data and Overwriting data. All risky commands may be found here https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga. A possible scenario when this might occur is when a malicious actor creates a search that includes commands that exfiltrate or damage data. The malicious actor then sends an unsuspecting user a link to the search. The URL contains a query string (q) and a search identifier (sid), but the sid is not valid. The malicious actor hopes the user will use the link and the search will run. During analysis, pivot based on user name and filter any user or queries not needed. Queries ran from a dashboard are seen as adhoc queries. When a query runs from a dashboard it will not show in audittrail logs the source dashboard name. The query defaults to adhoc and no Splunk system user activity. In addition, modify this query by removing key commands that generate too much noise, or too little, and create separate queries with higher confidence to alert on. + +- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Splunk_Audit](https://docs.splunk.com/Documentation/CIM/latest/User/SplunkAudit) +- **Last Updated**: 2022-05-23 +- **Author**: Michael Haag, Splunk +- **ID**: 1cf58ae1-9177-40b8-a26c-8966040f11ae + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Actions on Objectives + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [](https://nvd.nist.gov/vuln/detail/) | | | + + + +
+
+ +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("* +| runshellscript *", "* +| collect *","* +| delete *", "* +| fit *", "* +| outputcsv *", "* +| outputlookup *", "* +| run *", "* +| script *", "* +| sendalert *", "* +| sendemail *", "* +| tscolle*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type +| `drop_dm_object_name(Search_Activity)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `splunk_command_and_scripting_interpreter_risky_commands_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +> :information_source: +> **splunk_command_and_scripting_interpreter_risky_commands_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Search_Activity.search +* Search_Activity.info +* Search_Activity.total_run_time +* Search_Activity.user +* Search_Activity.savedsearch_name +* Search_Activity.search_type + + +#### How To Implement +To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. + +#### Known False Positives +False positives will be present until properly filtered by Username and search name. + +#### Associated Analytic story +* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 20.0 | 50 | 40 | A risky Splunk command has ran by $user$ and should be reviewed. | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning](https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning) +* [https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json](https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-05-24-splunk_protocol_impersonation_weak_encryption_simplerequest.md b/docs/_posts/2022-05-24-splunk_protocol_impersonation_weak_encryption_simplerequest.md new file mode 100644 index 0000000000..2592448e3b --- /dev/null +++ b/docs/_posts/2022-05-24-splunk_protocol_impersonation_weak_encryption_simplerequest.md @@ -0,0 +1,162 @@ +--- +title: "Splunk protocol impersonation weak encryption simplerequest" +excerpt: "Digital Certificates +" +categories: + - Application +last_modified_at: 2022-05-24 +toc: true +toc_label: "" +tags: + - Digital Certificates + - Resource Development + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +On Splunk version 9 on Python3 client libraries verify server certificates by default and use CA certificate store. This search warns a user about a failure to validate a certificate using python3 request. + +- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud + +- **Last Updated**: 2022-05-24 +- **Author**: Rod Soto, Splunk +- **ID**: 839d12a6-b119-4d44-ac4f-13eed95412c8 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1588.004](https://attack.mitre.org/techniques/T1588/004/) | Digital Certificates | Resource Development | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [](https://nvd.nist.gov/vuln/detail/) | | | + + + +
+
+ +#### Search + +``` +`splunk_python` "simpleRequest SSL certificate validation is enabled without hostname verification" +| stats count by host path +| `splunk_protocol_impersonation_weak_encryption_simplerequest_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [splunk_python](https://github.com/splunk/security_content/blob/develop/macros/splunk_python.yml) + +> :information_source: +> **splunk_protocol_impersonation_weak_encryption_simplerequest_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* host +* event_message +* path + + +#### How To Implement +Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. + +#### Known False Positives +This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089. + +#### Associated Analytic story +* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 40.0 | 50 | 80 | Failed to validate certificate on $host$ | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://www.splunk.com/en_us/product-security](https://www.splunk.com/en_us/product-security) +* [https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation](https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) +* [https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json](https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splk_protocol_impersonation_weak_encryption_simplerequest.txt](https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splk_protocol_impersonation_weak_encryption_simplerequest.txt) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-05-25-splunk_identified_ssl_tls_certificates.md b/docs/_posts/2022-05-25-splunk_identified_ssl_tls_certificates.md new file mode 100644 index 0000000000..6a235a7499 --- /dev/null +++ b/docs/_posts/2022-05-25-splunk_identified_ssl_tls_certificates.md @@ -0,0 +1,166 @@ +--- +title: "Splunk Identified SSL TLS Certificates" +excerpt: "Network Sniffing +" +categories: + - Network +last_modified_at: 2022-05-25 +toc: true +toc_label: "" +tags: + - Network Sniffing + - Credential Access + - Discovery + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - + - +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic uses tags of SSL, TLS and certificate to identify the usage of the Splunk default certificates being utilized in the environment. Recommended guidance is to utilize valid TLS certificates which documentation may be found in Splunk Docs - https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL. + +- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud + +- **Last Updated**: 2022-05-25 +- **Author**: Michael Haag, Splunk +- **ID**: 620fbb89-86fd-4e2e-925f-738374277586 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1040](https://attack.mitre.org/techniques/T1040/) | Network Sniffing | Credential Access, Discovery | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Reconnaissance + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [](https://nvd.nist.gov/vuln/detail/) | | | +| [](https://nvd.nist.gov/vuln/detail/) | | | + + + +
+
+ +#### Search + +``` +tag IN (ssl, tls, certificate) ssl_issuer_common_name=*splunk* +| stats values(src) AS "Host(s) with Default Cert" count by ssl_issuer ssl_subject_common_name ssl_subject_organization ssl_subject host sourcetype +| `splunk_identified_ssl_tls_certificates_filter` +``` + +#### Macros +The SPL above uses the following Macros: + +> :information_source: +> **splunk_identified_ssl_tls_certificates_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* ssl_issuer +* ssl_subject_common_name +* ssl_subject_organization +* ssl_subject +* host +* sourcetype + + +#### How To Implement +Ingestion of SSL/TLS data is needed and to be tagged properly as ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. + +#### Known False Positives +False positives will not be present as it is meant to assist with identifying default certificates being utilized. + +#### Associated Analytic story +* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 42.0 | 60 | 70 | The following $dest$ is using the self signed Splunk certificate. | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL](https://docs.splunk.com/Documentation/Splunk/8.2.6/Security/AboutsecuringyourSplunkconfigurationwithSSL) +* [https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json](https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1040/ssltls/ssl_splunk.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1040/ssltls/ssl_splunk.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/network/splunk_identified_ssl_tls_certificates.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-05-25-splunk_protocol_impersonation_weak_encryption_configuration.md b/docs/_posts/2022-05-25-splunk_protocol_impersonation_weak_encryption_configuration.md new file mode 100644 index 0000000000..45bacf61e1 --- /dev/null +++ b/docs/_posts/2022-05-25-splunk_protocol_impersonation_weak_encryption_configuration.md @@ -0,0 +1,167 @@ +--- +title: "Splunk Protocol Impersonation Weak Encryption Configuration" +excerpt: "Protocol Impersonation +" +categories: + - Application +last_modified_at: 2022-05-25 +toc: true +toc_label: "" +tags: + - Protocol Impersonation + - Command And Control + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +On June 14th, 2022, Splunk released a security advisory relating to TLS validation occuring within the httplib and urllib python libraries shipped with Splunk. In addition to upgrading to Splunk Enterprise 9.0 or later, several configuration settings need to be set. This search will check those configurations on the search head it is run from as well as its search peers. In addition to these settings, the PYTHONHTTPSVERIFY setting in $SPLUNK_HOME/etc/splunk-launch.conf needs to be enabled as well. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. + +- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud + +- **Last Updated**: 2022-05-25 +- **Author**: Lou Stella, Splunk +- **ID**: 900892bf-70a9-4787-8c99-546dd98ce461 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1001.003](https://attack.mitre.org/techniques/T1001/003/) | Protocol Impersonation | Command And Control | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [](https://nvd.nist.gov/vuln/detail/) | | | + + + +
+
+ +#### Search + +``` + +| rest /services/server/info +| table splunk_server version server_roles +| join splunk_server [ +| rest /servicesNS/nobody/search/configs/conf-server/ search="PythonSslClientConfig" +| table splunk_server sslVerifyServerCert sslVerifyServerName] +| join splunk_server [ +| rest /servicesNS/nobody/search/configs/conf-web/settings +| table splunk_server serverCert sslVersions] +| rename sslVerifyServerCert as "Server.conf:PythonSSLClientConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:PythonSSLClientConfig:sslVerifyServerName", serverCert as "Web.conf:Settings:serverCert", sslVersions as "Web.conf:Settings:sslVersions" +| `splunk_protocol_impersonation_weak_encryption_configuration_filter` +``` + +#### Macros +The SPL above uses the following Macros: + +> :information_source: +> **splunk_protocol_impersonation_weak_encryption_configuration_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* none + + +#### How To Implement +The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (The `dispatch_rest_to_indexers` capability). Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. + +#### Known False Positives +While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration. + +#### Associated Analytic story +* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 50.0 | 50 | 100 | $splunk_server$ may not be properly validating TLS Certificates | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation](https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) +* [https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html](https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html) +* [https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json](https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-05-26-macos_plutil.md b/docs/_posts/2022-05-26-macos_plutil.md index cb78981f6e..9d7140b763 100644 --- a/docs/_posts/2022-05-26-macos_plutil.md +++ b/docs/_posts/2022-05-26-macos_plutil.md @@ -109,8 +109,8 @@ Detect usage of plutil to modify plist files. Adversaries can modiy plist files #### Macros The SPL above uses the following Macros: -* [osquery](https://github.com/splunk/security_content/blob/develop/macros/osquery.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [osquery](https://github.com/splunk/security_content/blob/develop/macros/osquery.yml) > :information_source: > **macos_plutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-26-splunk_digital_certificates_infrastructure_version.md b/docs/_posts/2022-05-26-splunk_digital_certificates_infrastructure_version.md new file mode 100644 index 0000000000..f983cabd38 --- /dev/null +++ b/docs/_posts/2022-05-26-splunk_digital_certificates_infrastructure_version.md @@ -0,0 +1,165 @@ +--- +title: "Splunk Digital Certificates Infrastructure Version" +excerpt: "Digital Certificates +" +categories: + - Application +last_modified_at: 2022-05-26 +toc: true +toc_label: "" +tags: + - Digital Certificates + - Resource Development + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +This search will check the TLS validation is properly configured on the search head it is run from as well as its search peers after Splunk version 9. Other components such as additional search heads or anything this rest command cannot be distributed to will need to be manually checked. + +- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud + +- **Last Updated**: 2022-05-26 +- **Author**: Lou Stella, Splunk +- **ID**: 3c162281-7edb-4ebc-b9a4-5087aaf28fa7 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1587.003](https://attack.mitre.org/techniques/T1587/003/) | Digital Certificates | Resource Development | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [](https://nvd.nist.gov/vuln/detail/) | | | + + + +
+
+ +#### Search + +``` + +| rest /services/server/info +| table splunk_server version server_roles +| join splunk_server [ +| rest /servicesNS/nobody/search/configs/conf-server/ search="sslConfig" +| table splunk_server sslVerifyServerCert sslVerifyServerName serverCert] +| fillnull value="Not Set" +| rename sslVerifyServerCert as "Server.conf:SslConfig:sslVerifyServerCert", sslVerifyServerName as "Server.conf:SslConfig:sslVerifyServerName", serverCert as "Server.conf:SslConfig:serverCert" +| `splunk_digital_certificates_infrastructure_version_filter` +``` + +#### Macros +The SPL above uses the following Macros: + +> :information_source: +> **splunk_digital_certificates_infrastructure_version_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* none + + +#### How To Implement +The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) in some architectures. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. + +#### Known False Positives +No known at this time. + +#### Associated Analytic story +* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 50.0 | 50 | 100 | $splunk_server$ may not be properly validating TLS Certificates | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk-to-Splunk_communication](https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_Splunk-to-Splunk_communication) +* [https://www.splunk.com/en_us/product-security/announcements/svd-2022-0602.html](https://www.splunk.com/en_us/product-security/announcements/svd-2022-0602.html) +* [https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json](https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/application/splunk_digital_certificates_infrastructure_version.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-05-26-splunk_digital_certificates_lack_of_encryption.md b/docs/_posts/2022-05-26-splunk_digital_certificates_lack_of_encryption.md new file mode 100644 index 0000000000..cd8a5b7f2b --- /dev/null +++ b/docs/_posts/2022-05-26-splunk_digital_certificates_lack_of_encryption.md @@ -0,0 +1,165 @@ +--- +title: "Splunk Digital Certificates Lack of Encryption" +excerpt: "Digital Certificates +" +categories: + - Application +last_modified_at: 2022-05-26 +toc: true +toc_label: "" +tags: + - Digital Certificates + - Resource Development + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. In other circumstances, a client may be allowed to publish a forwarder bundle to other clients, which may allow for arbitrary code execution. The fixes for these require upgrading to at least Splunk 9.0 on the forwarder as well. This is a great opportunity to configure TLS across the environment. This search looks for forwarders that are not using TLS and adds risk to those entities. + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud + +- **Last Updated**: 2022-05-26 +- **Author**: Lou Stella, Splunk +- **ID**: 386a7ebc-737b-48cf-9ca8-5405459ed508 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1587.003](https://attack.mitre.org/techniques/T1587/003/) | Digital Certificates | Resource Development | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [](https://nvd.nist.gov/vuln/detail/) | | | + + + +
+
+ +#### Search + +``` +`splunkd` group="tcpin_connections" ssl="false" +| stats values(sourceIp) latest(fwdType) latest(version) by hostname +| `splunk_digital_certificates_lack_of_encryption_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [splunkd](https://github.com/splunk/security_content/blob/develop/macros/splunkd.yml) + +> :information_source: +> **splunk_digital_certificates_lack_of_encryption_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* group +* ssl +* sourceIp +* fwdType +* version +* hostname + + +#### How To Implement +This anomaly search looks for forwarder connections that are not currently using TLS. It then presents the source IP, the type of forwarder, and the version of the forwarder. You can also remove the "ssl=false" argument from the initial stanza in order to get a full list of all your forwarders that are sending data, and the version of Splunk software they are running, for audit purposes. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. + +#### Known False Positives +None at this time + +#### Associated Analytic story +* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 20.0 | 25 | 80 | $hostname$ is not using TLS when forwarding data | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html](https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html) +* [https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html](https://www.splunk.com/en_us/product-security/announcements/svd-2022-0601.html) +* [https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json](https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1587.003/splunk_fwder/splunkd.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1587.003/splunk_fwder/splunkd.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/application/splunk_digital_certificates_lack_of_encryption.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-05-26-splunk_process_injection_forwarder_bundle_downloads.md b/docs/_posts/2022-05-26-splunk_process_injection_forwarder_bundle_downloads.md new file mode 100644 index 0000000000..cfb560b194 --- /dev/null +++ b/docs/_posts/2022-05-26-splunk_process_injection_forwarder_bundle_downloads.md @@ -0,0 +1,166 @@ +--- +title: "Splunk Process Injection Forwarder Bundle Downloads" +excerpt: "Process Injection +" +categories: + - Application +last_modified_at: 2022-05-26 +toc: true +toc_label: "" +tags: + - Process Injection + - Defense Evasion + - Privilege Escalation + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - + - +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +On June 14th, 2022, Splunk released a security advisory relating to the authentication that happens between Universal Forwarders and Deployment Servers. In some circumstances, an unauthenticated client can download forwarder bundles from the Deployment Server. This hunting search pulls a full list of forwarder bundle downloads where the peer column is the forwarder, the host column is the Deployment Server, and then you have a list of the apps downloaded and the serverclasses in which the peer is a member of. You should look for apps or clients that you do not recognize as being part of your environment. + +- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud + +- **Last Updated**: 2022-05-26 +- **Author**: Lou Stella, Splunk +- **ID**: 8ea57d78-1aac-45d2-a913-0cd603fb6e9e + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [](https://nvd.nist.gov/vuln/detail/) | | | +| [](https://nvd.nist.gov/vuln/detail/) | | | + + + +
+
+ +#### Search + +``` +`splunkd` component="PackageDownloadRestHandler" +| stats values(app) values(serverclass) by peer, host +| `splunk_process_injection_forwarder_bundle_downloads_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [splunkd](https://github.com/splunk/security_content/blob/develop/macros/splunkd.yml) + +> :information_source: +> **splunk_process_injection_forwarder_bundle_downloads_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* component +* app +* serverclass +* peer +* host + + +#### How To Implement +This hunting search uses native logs produced when a deployment server is within your environment. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. + +#### Known False Positives +None at this time. + +#### Associated Analytic story +* [Splunk Vulnerabilites](/stories/splunk_vulnerabilites) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 35.0 | 50 | 70 | $peer$ downloaded apps from $host$ | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html](https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html) +* [https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json](https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/splunk_ds/splunkd.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/splunk_ds/splunkd.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-05-26-splunk_protocol_impersonation_weak_encryption_selfsigned.md b/docs/_posts/2022-05-26-splunk_protocol_impersonation_weak_encryption_selfsigned.md new file mode 100644 index 0000000000..88cca6ad70 --- /dev/null +++ b/docs/_posts/2022-05-26-splunk_protocol_impersonation_weak_encryption_selfsigned.md @@ -0,0 +1,162 @@ +--- +title: "Splunk protocol impersonation weak encryption selfsigned" +excerpt: "Digital Certificates +" +categories: + - Application +last_modified_at: 2022-05-26 +toc: true +toc_label: "" +tags: + - Digital Certificates + - Resource Development + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +On June 14th 2022, Splunk released vulnerability advisory addresing Python TLS validation which was not set before Splunk version 9. This search displays events showing WARNING of using Splunk issued default selfsigned certificates. + +- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud + +- **Last Updated**: 2022-05-26 +- **Author**: Rod Soto, Splunk +- **ID**: c76c7a2e-df49-414a-bb36-dce2683770de + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1588.004](https://attack.mitre.org/techniques/T1588/004/) | Digital Certificates | Resource Development | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [](https://nvd.nist.gov/vuln/detail/) | | | + + + +
+
+ +#### Search + +``` +`splunkd` certificate event_message="X509 certificate* should not be used*" +| stats count by host CN component log_level +| `splunk_protocol_impersonation_weak_encryption_selfsigned_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [splunkd](https://github.com/splunk/security_content/blob/develop/macros/splunkd.yml) + +> :information_source: +> **splunk_protocol_impersonation_weak_encryption_selfsigned_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* host +* CN +* event_message + + +#### How To Implement +Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks. + +#### Known False Positives +This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward. + +#### Associated Analytic story +* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 40.0 | 50 | 80 | Splunk default issued certificate at $host$ | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://www.splunk.com/en_us/product-security](https://www.splunk.com/en_us/product-security) +* [https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation](https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) +* [https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json](https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splunk_protocol_impersonation_weak_encryption_selfsigned.txt](https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1558.004/splunk_protocol_impersonation_weak_encryption_selfsigned.txt) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_delete_usage.md b/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_delete_usage.md new file mode 100644 index 0000000000..1f47edb329 --- /dev/null +++ b/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_delete_usage.md @@ -0,0 +1,170 @@ +--- +title: "Splunk Command and Scripting Interpreter Delete Usage" +excerpt: "Command and Scripting Interpreter +" +categories: + - Application +last_modified_at: 2022-05-27 +toc: true +toc_label: "" +tags: + - Command and Scripting Interpreter + - Execution + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - + - Splunk_Audit +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies the use of the risky command - Delete - that may be utilized in Splunk to delete some or all data queried for. In order to use Delete in Splunk, one must be assigned the role. This is typically not used and should generate an anomaly if it is used. + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Splunk_Audit](https://docs.splunk.com/Documentation/CIM/latest/User/SplunkAudit) +- **Last Updated**: 2022-05-27 +- **Author**: Michael Haag, Splunk +- **ID**: 8d3d5d5e-ca43-42be-aa1f-bc64375f6b04 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Actions on Objectives + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [](https://nvd.nist.gov/vuln/detail/) | | | + + + +
+
+ +#### Search + +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search IN ("* +| delete*") Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.info Search_Activity.total_run_time Search_Activity.user Search_Activity.search_type +| `drop_dm_object_name(Search_Activity)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `splunk_command_and_scripting_interpreter_delete_usage_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +> :information_source: +> **splunk_command_and_scripting_interpreter_delete_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Search_Activity.search +* Search_Activity.info +* Search_Activity.total_run_time +* Search_Activity.user +* Search_Activity.savedsearch_name +* Search_Activity.search_type + + +#### How To Implement +To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. + +#### Known False Positives +False positives may be present if this command is used as a common practice. Filter as needed. + +#### Associated Analytic story +* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 27.0 | 90 | 30 | $user$ executed the 'delete' command, if this is unexpected it should be reviewed. | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning](https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1213/audittrail/audittrail.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_risky_spl_mltk.md b/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_risky_spl_mltk.md new file mode 100644 index 0000000000..e6e8cc21a6 --- /dev/null +++ b/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_risky_spl_mltk.md @@ -0,0 +1,176 @@ +--- +title: "Splunk Command and Scripting Interpreter Risky SPL MLTK" +excerpt: "Command and Scripting Interpreter +" +categories: + - Application +last_modified_at: 2022-05-27 +toc: true +toc_label: "" +tags: + - Command and Scripting Interpreter + - Execution + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - + - Splunk_Audit +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +This detection utilizes machine learning model named "risky_command_abuse" trained from "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline". It should be scheduled to run hourly to detect whether a user has run searches containing risky SPL from this list https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warninga with abnormally long running time in the past one hour, comparing with his/her past seven days history. This search uses the trained baseline to infer whether a search is an outlier (isOutlier ~= 1.0) or not (isOutlier~= 0.0) + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Splunk_Audit](https://docs.splunk.com/Documentation/CIM/latest/User/SplunkAudit) +- **Last Updated**: 2022-05-27 +- **Author**: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk +- **ID**: 19d0146c-2eae-4e53-8d39-1198a78fa9ca + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Actions on Objectives + + +
+
+ + +
+ NIST + +
+ +* DE.AE + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 6 + + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [](https://nvd.nist.gov/vuln/detail/) | | | + + + +
+
+ +#### Search + +``` + +| tstats sum(Search_Activity.total_run_time) AS run_time, values(Search_Activity.search) as searches, count FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") AND (Search_Activity.total_run_time>1) AND (earliest=-1h@h latest=now) AND (Search_Activity.search IN ("* +| runshellscript *", "* +| collect *","* +| delete *", "* +| fit *", "* +| outputcsv *", "* +| outputlookup *", "* +| run *", "* +| script *", "* +| sendalert *", "* +| sendemail *", "* +| tscolle*")) AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) BY _time, Search_Activity.user span=1h +| apply risky_command_abuse +| fields _time, Search_Activity.user, searches, run_time, IsOutlier(run_time) +| rename IsOutlier(run_time) as isOutlier, _time as timestamp +| where isOutlier>0.5 +| `splunk_command_and_scripting_interpreter_risky_spl_mltk_filter` +``` + +#### Macros +The SPL above uses the following Macros: + +> :information_source: +> **splunk_command_and_scripting_interpreter_risky_spl_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Search_Activity.search +* Search_Activity.total_run_time +* Search_Activity.user +* Search_Activity.search_type + + +#### How To Implement +This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Baseline model needs to be built using "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline" before this search can run. Please note that the current search only finds matches exactly one space between separator bar and risky commands. + +#### Known False Positives +If the run time of a search exceeds the boundaries of outlier defined by the fitted density function model, false positives can occur, incorrectly labeling a long running search as potentially risky. + +#### Associated Analytic story +* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 20.0 | 50 | 40 | Abnormally long run time for risk SPL command seen by user $(Search_Activity.user). | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning](https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt](https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md b/docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md new file mode 100644 index 0000000000..174eac3cf3 --- /dev/null +++ b/docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md @@ -0,0 +1,170 @@ +--- +title: "MSHTML Module Load in Office Product" +excerpt: "Phishing +, Spearphishing Attachment +" +categories: + - Endpoint +last_modified_at: 2022-06-01 +toc: true +toc_label: "" +tags: + - Phishing + - Spearphishing Attachment + - Initial Access + - Initial Access + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - CVE-2021-40444 + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +The following detection identifies the module load of mshtml.dll into an Office product. This behavior has been related to CVE-2021-40444, whereas the malicious document will load ActiveX, which activates the MSHTML component. The vulnerability resides in the MSHTML component. During triage, identify parallel processes and capture any file modifications for analysis. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-06-01 +- **Author**: Michael Haag, Mauricio Velazco, Splunk +- **ID**: 5f1c168e-118b-11ec-84ff-acde48001122 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | + +| [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ + + +
+
+ +
+ CIS20 + +
+ + + +
+
+ +
+ CVE + +
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 | + + + +
+
+ +#### Search + +``` +`sysmon` EventID=7 process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") +| stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, ImageLoaded, OriginalFileName, ProcessGuid +| rename Computer as dest +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `mshtml_module_load_in_office_product_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) + +> :information_source: +> **mshtml_module_load_in_office_product_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* ImageLoaded +* process_name +* OriginalFileName +* process_id +* dest + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process names and image loads from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +#### Known False Positives +Limited false positives will be present, however, tune as necessary. + +#### Associated Analytic story +* [Spearphishing Attachments](/stories/spearphishing_attachments) +* [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 80.0 | 80 | 100 | An instance of $process_name$ was identified on endpoint $dest$ loading mshtml.dll. | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/](https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/) +* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444) +* [https://strontic.github.io/xcyclopedia/index-dll](https://strontic.github.io/xcyclopedia/index-dll) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_mshtml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_mshtml.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/mshtml_module_load_in_office_product.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md b/docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md new file mode 100644 index 0000000000..a841bd35e8 --- /dev/null +++ b/docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md @@ -0,0 +1,170 @@ +--- +title: "Suspicious Process With Discord DNS Query" +excerpt: "Visual Basic +, Command and Scripting Interpreter +" +categories: + - Endpoint +last_modified_at: 2022-06-01 +toc: true +toc_label: "" +tags: + - Visual Basic + - Command and Scripting Interpreter + - Execution + - Execution + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic identifies a process making a DNS query to Discord, a well known instant messaging and digital distribution platform. Discord can be abused by adversaries, as seen in the WhisperGate campaign, to host and download malicious. external files. A process resolving a Discord DNS name could be an indicator of malware trying to download files from Discord for further execution. + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-06-01 +- **Author**: Teoderick Contreras, Mauricio Velazco, Splunk +- **ID**: 4d4332ae-792c-11ec-89c1-acde48001122 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1059.005](https://attack.mitre.org/techniques/T1059/005/) | Visual Basic | Execution | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ +* DE.CM + + + +
+
+ +
+ CIS20 + +
+ +* CIS 3 +* CIS 5 +* CIS 16 + + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` +`sysmon` EventCode=22 QueryName IN ("*discord*") Image != "*\\AppData\\Local\\Discord\\*" AND Image != "*\\Program Files*" AND Image != "discord.exe" +| stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus process_name QueryResults Computer +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `suspicious_process_with_discord_dns_query_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) + +> :information_source: +> **suspicious_process_with_discord_dns_query_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Image +* QueryName +* QueryStatus +* process_name +* QueryResults +* Computer + + +#### How To Implement +his detection relies on sysmon logs with the Event ID 22, DNS Query. + +#### Known False Positives +Noise and false positive can be seen if the following instant messaging is allowed to use within corporate network. In this case, a filter is needed. + +#### Associated Analytic story +* [WhisperGate](/stories/whispergate) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 64.0 | 80 | 80 | suspicious process $process_name$ has a dns query in $QueryName$ on $Computer$ | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/](https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/) +* [https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3](https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3) +* [https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/](https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/discord_dnsquery/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/discord_dnsquery/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/suspicious_process_with_discord_dns_query.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md b/docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md new file mode 100644 index 0000000000..8cc453ba00 --- /dev/null +++ b/docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md @@ -0,0 +1,165 @@ +--- +title: "Wermgr Process Connecting To IP Check Web Services" +excerpt: "Gather Victim Network Information +, IP Addresses +" +categories: + - Endpoint +last_modified_at: 2022-06-01 +toc: true +toc_label: "" +tags: + - Gather Victim Network Information + - IP Addresses + - Reconnaissance + - Reconnaissance + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +this search is designed to detect suspicious wermgr.exe process that tries to connect to known IP web services. This technique is know for trickbot and other trojan spy malware to recon the infected machine and look for its ip address without so much finger print on the commandline process. Since wermgr.exe is designed for error handling process of windows it is really suspicious that this process is trying to connect to this IP web services cause that maybe cause of some malicious code injection. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Last Updated**: 2022-06-01 +- **Author**: Teoderick Contreras, Mauricio Velazco, Splunk +- **ID**: ed313326-a0f9-11eb-a89c-acde48001122 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1590](https://attack.mitre.org/techniques/T1590/) | Gather Victim Network Information | Reconnaissance | + +| [T1590.005](https://attack.mitre.org/techniques/T1590/005/) | IP Addresses | Reconnaissance | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ + + +
+
+ +
+ CIS20 + +
+ + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` +`sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net") +| stats min(_time) as firstTime max(_time) as lastTime count by Image process_name ProcessId QueryName QueryStatus QueryResults Computer EventCode +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `wermgr_process_connecting_to_ip_check_web_services_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) + +> :information_source: +> **wermgr_process_connecting_to_ip_check_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* process_path +* process_name +* process_id +* QueryName +* QueryStatus +* QueryResults +* Computer +* EventCode + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from your endpoints like EventCode 22. If you are using Sysmon, you must have at least version 12 of the Sysmon TA. + +#### Known False Positives +unknown + +#### Associated Analytic story +* [Trickbot](/stories/trickbot) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 56.0 | 70 | 80 | Wermgr.exe process connecting IP location web services on $ComputerName$ | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://labs.vipre.com/trickbot-and-its-modules/](https://labs.vipre.com/trickbot-and-its-modules/) +* [https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html](https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2022-06-01-windows_installutil_credential_theft.md b/docs/_posts/2022-06-01-windows_installutil_credential_theft.md new file mode 100644 index 0000000000..08612d4668 --- /dev/null +++ b/docs/_posts/2022-06-01-windows_installutil_credential_theft.md @@ -0,0 +1,171 @@ +--- +title: "Windows InstallUtil Credential Theft" +excerpt: "InstallUtil +, System Binary Proxy Execution +" +categories: + - Endpoint +last_modified_at: 2022-06-01 +toc: true +toc_label: "" +tags: + - InstallUtil + - System Binary Proxy Execution + - Defense Evasion + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies the Windows InstallUtil.exe binary loading `vaultcli.dll` and Samlib.dll`. This technique may be used to execute code to bypassing application control and capture credentials by utilizing a tool like MimiKatz. \ +When `InstallUtil.exe` is used in a malicous manner, the path to an executable on the filesystem is typically specified. Take note of the parent process. In a suspicious instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` or `Explorer.exe`. \ +If used by a developer, typically this will be found with multiple command-line switches/arguments and spawn from Visual Studio. \ +During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Last Updated**: 2022-06-01 +- **Author**: Michael Haag, Mauricio Velazo, Splunk +- **ID**: ccfeddec-43ec-11ec-b494-acde48001122 + + +#### Annotations + +
+ ATT&CK + +
+ + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1218.004](https://attack.mitre.org/techniques/T1218/004/) | InstallUtil | Defense Evasion | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion | + +
+
+ + +
+ Kill Chain Phase + +
+ +* Exploitation + + +
+
+ + +
+ NIST + +
+ + + +
+
+ +
+ CIS20 + +
+ + + +
+
+ +
+ CVE + +
+ + +
+
+ +#### Search + +``` +`sysmon` EventCode=7 process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll", "*\\vaultcli.dll") +| stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, ImageLoaded, OriginalFileName, ProcessId +| rename Computer as dest +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `windows_installutil_credential_theft_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) + +> :information_source: +> **windows_installutil_credential_theft_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and module loads from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +#### Known False Positives +Typically this will not trigger as by it's very nature InstallUtil does not need credentials. Filter as needed. + +#### Associated Analytic story +* [Signed Binary Proxy Execution InstallUtil](/stories/signed_binary_proxy_execution_installutil) + + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ loading samlib.dll and vaultcli.dll to potentially capture credentials in memory. | + + +> :information_source: +> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. + +#### Reference + +* [https://gist.github.com/xorrior/bbac3919ca2aef8d924bdf3b16cce3d0](https://gist.github.com/xorrior/bbac3919ca2aef8d924bdf3b16cce3d0) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_installutil_credential_theft.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md b/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md index 93e889596e..0acdbed77f 100644 --- a/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md +++ b/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md @@ -106,8 +106,8 @@ This search is to detect potential DNS exfiltration using nslookup application. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **excessive_usage_of_nslookup_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_stories/splunk_vulnerabilities.md b/docs/_stories/splunk_vulnerabilities.md index 062660f7ef..a6397c199f 100644 --- a/docs/_stories/splunk_vulnerabilities.md +++ b/docs/_stories/splunk_vulnerabilities.md @@ -7,6 +7,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + - Splunk_Audit + - Actions on Objectives - Delivery - Exploitation - Reconnaissance @@ -19,7 +21,7 @@ tags: Keeping your Splunk Enterprise deployment up to date is critical and will help you reduce the risk associated with vulnerabilities in the product. - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: +- **Datamodel**: [Splunk_Audit](https://docs.splunk.com/Documentation/CIM/latest/User/SplunkAudit) - **Last Updated**: 2022-03-28 - **Author**: Lou Stella, Splunk - **ID**: 5354df00-dce2-48ac-9a64-8adb48006828 @@ -33,11 +35,20 @@ This analytic story includes detections that focus on attacker behavior targeted | Name | Technique | Type | | ----------- | ----------- |--------------| | [Path traversal SPL injection](/application/path_traversal_spl_injection/) | [File and Directory Discovery](/tags/#file-and-directory-discovery)| TTP | +| [Splunk Command and Scripting Interpreter Delete Usage](/application/splunk_command_and_scripting_interpreter_delete_usage/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Anomaly | +| [Splunk Command and Scripting Interpreter Risky Commands](/application/splunk_command_and_scripting_interpreter_risky_commands/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Hunting | +| [Splunk Command and Scripting Interpreter Risky SPL MLTK](/application/splunk_command_and_scripting_interpreter_risky_spl_mltk/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Anomaly | +| [Splunk Digital Certificates Infrastructure Version](/application/splunk_digital_certificates_infrastructure_version/) | [Digital Certificates](/tags/#digital-certificates)| Hunting | +| [Splunk Digital Certificates Lack of Encryption](/application/splunk_digital_certificates_lack_of_encryption/) | [Digital Certificates](/tags/#digital-certificates)| Anomaly | | [Splunk DoS via Malformed S2S Request](/application/splunk_dos_via_malformed_s2s_request/) | [Network Denial of Service](/tags/#network-denial-of-service)| TTP | +| [Splunk Protocol Impersonation Weak Encryption Configuration](/application/splunk_protocol_impersonation_weak_encryption_configuration/) | [Protocol Impersonation](/tags/#protocol-impersonation)| Hunting | +| [Splunk protocol impersonation weak encryption selfsigned](/application/splunk_protocol_impersonation_weak_encryption_selfsigned/) | [Digital Certificates](/tags/#digital-certificates)| Hunting | +| [Splunk protocol impersonation weak encryption simplerequest](/application/splunk_protocol_impersonation_weak_encryption_simplerequest/) | [Digital Certificates](/tags/#digital-certificates)| Hunting | | [Splunk User Enumeration Attempt](/application/splunk_user_enumeration_attempt/) | [Valid Accounts](/tags/#valid-accounts)| TTP | | [Splunk XSS in Monitoring Console](/application/splunk_xss_in_monitoring_console/) | [Drive-by Compromise](/tags/#drive-by-compromise)| TTP | | [Open Redirect in Splunk Web](/deprecated/open_redirect_in_splunk_web/) | None| TTP | | [Splunk Enterprise Information Disclosure](/deprecated/splunk_enterprise_information_disclosure/) | None| TTP | +| [Splunk Identified SSL TLS Certificates](/network/splunk_identified_ssl_tls_certificates/) | [Network Sniffing](/tags/#network-sniffing)| Hunting | #### Reference diff --git a/docs/mitre-map/coverage.json b/docs/mitre-map/coverage.json index cf184a001b..6512d1e53b 100644 --- a/docs/mitre-map/coverage.json +++ b/docs/mitre-map/coverage.json @@ -9,11 +9,36 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/path_traversal_spl_injection.yml" }, + { + "techniqueID": "T1059", + "score": 43, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_carry_out_string_command_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/macos_lolbin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_writing_dynamicwrapperx.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_with_discord_dns_query.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/vbscript_execution_using_wscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_module_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml" + }, + { + "techniqueID": "T1587.003", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_digital_certificates_infrastructure_version.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_digital_certificates_lack_of_encryption.yml" + }, { "techniqueID": "T1498", "score": 7, "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_dos_via_malformed_s2s_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_arp_poisoning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_traffic_mirroring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/large_volume_of_dns_any_queries.yml" }, + { + "techniqueID": "T1055", + "score": 20, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_with_namedpipe_commandline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml" + }, + { + "techniqueID": "T1001.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_protocol_impersonation_weak_encryption_configuration.yml" + }, + { + "techniqueID": "T1588.004", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_protocol_impersonation_weak_encryption_selfsigned.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_protocol_impersonation_weak_encryption_simplerequest.yml" + }, { "techniqueID": "T1078", "score": 36, @@ -339,11 +364,6 @@ "score": 23, "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_operation_with_consent_admin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_uac_remote_restriction.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_common_process_for_elevation_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_doas_conf_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_doas_tool_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_access_to_sudoers_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_setuid_using_chmod_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_setuid_using_setcap_utility.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_sudo_or_su_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_sudoers_tmp_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_visudo_utility_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/net_profiler_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sdclt_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/services_escalate_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/silentcleanup_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_runas_elevated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/slui_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsreset_uac_bypass.yml" }, - { - "techniqueID": "T1059", - "score": 40, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_carry_out_string_command_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/macos_lolbin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_writing_dynamicwrapperx.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_with_discord_dns_query.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/vbscript_execution_using_wscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_module_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml" - }, { "techniqueID": "T1105", "score": 12, @@ -429,11 +449,6 @@ "score": 3, "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml" }, - { - "techniqueID": "T1055", - "score": 19, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_with_namedpipe_commandline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml" - }, { "techniqueID": "T1485", "score": 17, @@ -1103,6 +1118,11 @@ "techniqueID": "T1498.002", "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/large_volume_of_dns_any_queries.yml" + }, + { + "techniqueID": "T1040", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/splunk_identified_ssl_tls_certificates.yml" } ], "gradient": { From b392ca9aa5aed60980ba7a50441e1130e704d718 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 14 Jun 2022 09:58:09 -0500 Subject: [PATCH 144/148] Update splunk_process_injection_forwarder_bundle_downloads.yml Spelling fix --- .../splunk_process_injection_forwarder_bundle_downloads.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml index 4372fc3ac5..cf8263c8a8 100644 --- a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml +++ b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml @@ -14,7 +14,7 @@ references: - https://www.github.com/splunk/security_content/blob/develop/workbooks/splunk_psa_0622.json tags: analytic_story: - - Splunk Vulnerabilites + - Splunk Vulnerabilities asset_type: Endpoint cis20: - CIS 3 From 72c71bbfcb6763909c825b35376482afa34a06cb Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 14 Jun 2022 10:38:43 -0500 Subject: [PATCH 145/148] update site --- docs/_pages/stories.md | 2 +- .../2017-09-23-monitor_web_traffic_for_brand_abuse.md | 2 +- ...18-04-18-detect_spike_in_security_group_activity.md | 2 +- .../2018-05-21-detect_spike_in_network_acl_activity.md | 2 +- docs/_posts/2018-12-03-remote_wmi_command_attempt.md | 2 +- docs/_posts/2018-12-06-suspicious_java_classes.md | 2 +- ...3-detect_credential_dumping_through_lsass_access.md | 2 +- .../2019-12-03-detect_mimikatz_using_loaded_images.md | 2 +- ...2019-12-06-access_lsass_memory_for_dump_creation.md | 2 +- .../2019-12-06-create_remote_thread_into_lsass.md | 2 +- .../2019-12-06-unsigned_image_loaded_by_lsass.md | 2 +- .../2020-02-03-creation_of_lsass_dump_with_taskmgr.md | 2 +- docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md | 2 +- ...-15-amazon_eks_kubernetes_cluster_scan_detection.md | 2 +- ...0-04-15-amazon_eks_kubernetes_pod_scan_detection.md | 2 +- ...2020-05-20-first_time_seen_child_process_of_zoom.md | 2 +- .../2020-07-21-attempt_to_stop_security_service.md | 2 +- ..._requests_to_phishing_sites_leveraging_evilginx2.md | 10 +++++----- ...ous_powershell_process_-_execution_policy_bypass.md | 2 +- ...2-suspicious_writes_to_system_volume_information.md | 2 +- ...7-28-detect_windows_dns_sigred_via_splunk_stream.md | 2 +- ...16-create_or_delete_windows_shares_using_net_exe.md | 2 +- ...-detect_prohibited_applications_spawning_cmd_exe.md | 2 +- ...8-system_processes_run_from_unexpected_locations.md | 2 +- ...12-14-sunburst_correlation_dll_and_network_event.md | 2 +- ...-12-suspicious_microsoft_workflow_compiler_usage.md | 2 +- docs/_posts/2021-01-12-suspicious_msbuild_spawn.md | 2 +- ...ect_hosts_connecting_to_dynamic_domain_providers.md | 2 +- ...s_powershell_process_with_obfuscation_techniques.md | 2 +- .../2021-01-20-detect_rundll32_inline_hta_execution.md | 2 +- docs/_posts/2021-01-20-suspicious_mshta_spawn.md | 2 +- ...01-28-detect_regsvr32_application_control_bypass.md | 2 +- ...-28-suspicious_regsvr32_register_suspicious_path.md | 2 +- .../2021-02-01-dump_lsass_via_procdump_rename.md | 2 +- ...ct_rundll32_application_control_bypass_-_advpack.md | 2 +- ...t_rundll32_application_control_bypass_-_setupapi.md | 2 +- ...t_rundll32_application_control_bypass_-_syssetup.md | 2 +- docs/_posts/2021-02-04-suspicious_rundll32_startw.md | 2 +- ...2021-02-09-suspicious_rundll32_dllregisterserver.md | 2 +- docs/_posts/2021-03-03-nishang_powershelltcponeline.md | 2 +- docs/_posts/2021-03-03-w3wp_spawning_shell.md | 4 ++-- .../2021-03-12-ransomware_notes_bulk_creation.md | 2 +- .../2021-03-16-high_process_termination_frequency.md | 2 +- .../2021-03-16-windows_high_file_deletion_frequency.md | 2 +- .../_posts/2021-03-29-powershell_start-bitstransfer.md | 2 +- docs/_posts/2021-04-12-excel_spawning_powershell.md | 2 +- docs/_posts/2021-04-12-winword_spawning_powershell.md | 2 +- ...-04-13-office_application_spawn_rundll32_process.md | 2 +- ...021-04-14-office_document_creating_schedule_task.md | 2 +- .../2021-04-14-office_document_executing_macro_code.md | 2 +- ...owershell_remote_thread_to_known_windows_process.md | 2 +- ...2021-04-19-wermgr_process_create_executable_file.md | 2 +- ...wermgr_process_spawned_cmd_or_powershell_process.md | 4 ++-- ...1-04-21-multiple_archive_files_http_post_traffic.md | 2 +- ...-22-office_product_spawning_rundll32_with_no_dll.md | 2 +- .../2021-04-22-plain_http_post_exfiltrated_data.md | 2 +- docs/_posts/2021-04-22-winword_spawning_cmd.md | 2 +- .../2021-04-26-office_product_spawning_bitsadmin.md | 2 +- .../_posts/2021-04-26-office_product_spawning_mshta.md | 2 +- docs/_posts/2021-04-26-trickbot_named_pipe.md | 2 +- .../_posts/2021-04-29-suspicious_driver_loaded_path.md | 2 +- docs/_posts/2021-04-29-xmrig_driver_loaded.md | 2 +- docs/_posts/2021-05-04-deleting_of_net_users.md | 2 +- docs/_posts/2021-05-04-disabling_net_user_account.md | 2 +- .../2021-05-04-excessive_service_stop_attempt.md | 2 +- .../2021-05-04-process_kill_base_on_file_path.md | 2 +- .../_posts/2021-05-06-download_files_using_telegram.md | 2 +- docs/_posts/2021-05-06-excessive_usage_of_net_app.md | 2 +- docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md | 2 +- docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md | 2 +- docs/_posts/2021-06-02-modification_of_wallpaper.md | 2 +- .../_posts/2021-06-02-wbemprox_com_object_execution.md | 2 +- ...-06-16-detect_wmi_event_subscription_persistence.md | 2 +- ...06-22-recursive_delete_of_directory_in_batch_cmd.md | 2 +- ...2021-06-24-excessive_usage_of_sc_service_utility.md | 2 +- ...2021-07-01-print_spooler_adding_a_printer_driver.md | 2 +- ...021-07-01-print_spooler_failed_to_load_a_plug-in.md | 2 +- docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md | 2 +- .../2021-07-01-spoolsv_suspicious_loaded_modules.md | 2 +- .../2021-07-01-spoolsv_suspicious_process_access.md | 2 +- .../2021-07-01-spoolsv_writing_a_dll_-_sysmon.md | 2 +- ...021-07-05-powershell_disable_security_monitoring.md | 2 +- .../2021-07-12-uac_bypass_mmc_load_unsigned_dll.md | 2 +- ...7-19-mshta_spawning_rundll32_or_regsvr32_process.md | 4 ++-- .../2021-07-19-office_product_spawn_cmd_process.md | 2 +- ...021-07-26-rundll32_createremotethread_in_browser.md | 2 +- ...21-07-26-rundll32_process_creating_exe_dll_files.md | 2 +- .../2021-07-26-suspicious_icedid_rundll32_cmdline.md | 2 +- .../2021-07-26-suspicious_rundll32_plugininit.md | 2 +- ...-07-27-regsvr32_with_known_silent_switch_cmdline.md | 2 +- ...07-29-rundll32_create_remote_thread_to_a_process.md | 2 +- docs/_posts/2021-07-30-drop_icedid_license_dat.md | 2 +- ...-07-30-icedid_exfiltrated_archived_file_creation.md | 2 +- ...-07-30-office_application_spawn_regsvr32_process.md | 2 +- docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md | 2 +- ...-08-04-create_remote_thread_in_shell_application.md | 2 +- .../2021-08-13-uac_bypass_with_colorui_com_object.md | 2 +- ...2021-08-24-domain_account_discovery_with_net_app.md | 2 +- .../2021-08-24-kubernetes_scanner_image_pulling.md | 2 +- .../2021-08-27-exchange_powershell_abuse_via_ssrf.md | 2 +- .../2021-09-01-circle_ci_disable_security_step.md | 2 +- ...2021-09-01-github_pull_request_from_unknown_user.md | 2 +- .../2021-09-02-circle_ci_disable_security_job.md | 2 +- ...che_change_by_app_connect_and_create_adsi_object.md | 2 +- docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md | 2 +- ...rundll32_control_rundll_world_writable_directory.md | 2 +- docs/_posts/2021-09-09-extraction_of_registry_hives.md | 2 +- ...1-09-13-ms_scripting_process_loading_ldap_module.md | 2 +- ...21-09-13-ms_scripting_process_loading_wmi_module.md | 2 +- .../2021-09-13-xsl_script_execution_with_wmic.md | 2 +- .../2021-09-16-account_discovery_with_net_app.md | 2 +- ...empted_credential_dump_from_registry_via_reg_exe.md | 2 +- docs/_posts/2021-09-16-bits_job_persistence.md | 2 +- docs/_posts/2021-09-16-bitsadmin_download_file.md | 2 +- ...creation_of_shadow_copy_with_wmic_and_powershell.md | 4 ++-- ...ential_dumping_via_copy_command_from_shadow_copy.md | 2 +- ...16-credential_dumping_via_symlink_to_shadow_copy.md | 2 +- .../2021-09-16-detect_html_help_url_in_command_line.md | 2 +- ...detect_html_help_using_infotech_storage_handlers.md | 2 +- .../2021-09-16-detect_mshta_inline_hta_execution.md | 2 +- .../2021-09-16-detect_mshta_url_in_command_line.md | 2 +- docs/_posts/2021-09-16-dump_lsass_via_procdump.md | 2 +- .../2021-09-16-local_account_discovery_with_net.md | 2 +- .../2021-09-16-local_account_discovery_with_wmic.md | 2 +- docs/_posts/2021-09-16-office_product_spawning_wmic.md | 2 +- docs/_posts/2021-09-29-verclsid_clsid_execution.md | 2 +- ...-04-msbuild_suspicious_spawned_by_script_process.md | 2 +- ...04-regsvr32_silent_and_install_param_dll_loading.md | 2 +- docs/_posts/2021-10-05-rundll32_shimcache_flush.md | 2 +- .../_posts/2021-10-06-sdelete_application_execution.md | 2 +- ...0-14-serviceprincipalnames_discovery_with_setspn.md | 2 +- ...1-10-19-windows_curl_download_to_suspicious_path.md | 2 +- ...-11-10-windows_curl_upload_to_remote_destination.md | 2 +- docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md | 2 +- .../2021-11-12-csc_net_on_the_fly_compilation.md | 2 +- ...-11-12-network_discovery_using_route_windows_app.md | 2 +- .../2021-11-12-remote_process_instantiation_via_wmi.md | 2 +- .../2021-11-12-windows_installutil_uninstall_option.md | 2 +- ...21-11-12-windows_installutil_url_in_command_line.md | 2 +- ...te_process_instantiation_via_dcom_and_powershell.md | 2 +- ...ote_process_instantiation_via_wmi_and_powershell.md | 2 +- ...e_process_instantiation_via_winrm_and_powershell.md | 2 +- docs/_posts/2021-11-18-loading_of_dynwrapx_module.md | 2 +- ...021-12-08-msi_module_loaded_by_non-system_binary.md | 2 +- docs/_posts/2021-12-13-windows_java_spawning_shells.md | 2 +- ...ershell_-_connect_to_internet_with_hidden_window.md | 2 +- ...2-windows_hunting_system_account_targeting_lsass.md | 2 +- ...01-12-windows_non-system_account_targeting_lsass.md | 2 +- ...022-01-18-cmd_carry_out_string_command_parameter.md | 2 +- ...8-malicious_powershell_process_-_encoded_command.md | 2 +- ...cious_process_dns_query_known_abuse_web_services.md | 2 +- ...01-19-windows_dotnet_binary_in_non_standard_path.md | 2 +- ...2-01-19-windows_installutil_in_non_standard_path.md | 2 +- ...20-excessive_file_deletion_in_windefender_folder.md | 2 +- docs/_posts/2022-01-20-ping_sleep_batch_command.md | 2 +- .../2022-01-27-windows_possible_credential_dumping.md | 2 +- ..._kerberos_ticket_exports_through_winlogon_access.md | 2 +- ...02-07-windows_remote_assistance_spawning_process.md | 2 +- .../_posts/2022-02-08-rundll_loading_dll_by_ordinal.md | 2 +- ...7-windows_raw_access_to_master_boot_record_drive.md | 2 +- ...2022-02-18-detect_regasm_with_network_connection.md | 2 +- ...022-02-18-detect_regsvcs_with_network_connection.md | 2 +- ...022-02-18-process_deleting_its_process_file_path.md | 2 +- docs/_posts/2022-02-18-rundll32_dnsquery.md | 2 +- .../2022-02-22-windows_wmi_process_call_create.md | 2 +- ...2-25-windows_raw_access_to_disk_volume_partition.md | 2 +- docs/_posts/2022-03-08-suspicious_msbuild_path.md | 2 +- ...15-detect_regsvcs_with_no_command_line_arguments.md | 2 +- ...ll32_with_no_command_line_arguments_with_network.md | 2 +- ...15-suspicious_gpupdate_no_command_line_arguments.md | 2 +- ...15-suspicious_rundll32_no_command_line_arguments.md | 2 +- ...16-windows_installutil_remote_network_connection.md | 2 +- ...indows_installutil_uninstall_option_with_network.md | 2 +- .../2022-03-28-windows_terminating_lsass_process.md | 2 +- .../2022-03-30-windows_drivers_loaded_by_signature.md | 2 +- ...04-06-web_spring4shell_http_request_class_module.md | 2 +- docs/_posts/2022-04-07-any_powershell_downloadfile.md | 2 +- .../_posts/2022-04-07-any_powershell_downloadstring.md | 2 +- .../_posts/2022-04-18-nltest_domain_trust_discovery.md | 2 +- ...windows_processes_killed_by_industroyer2_malware.md | 2 +- docs/_posts/2022-05-16-cobalt_strike_named_pipes.md | 2 +- ...unk_process_injection_forwarder_bundle_downloads.md | 2 +- .../2022-06-01-mshtml_module_load_in_office_product.md | 2 +- ...-06-01-suspicious_process_with_discord_dns_query.md | 2 +- ...rmgr_process_connecting_to_ip_check_web_services.md | 2 +- .../2022-06-01-windows_installutil_credential_theft.md | 2 +- .../2022-06-03-excessive_usage_of_nslookup_app.md | 2 +- docs/_stories/splunk_vulnerabilities.md | 1 + 188 files changed, 196 insertions(+), 195 deletions(-) diff --git a/docs/_pages/stories.md b/docs/_pages/stories.md index 18efa21234..abecdac106 100644 --- a/docs/_pages/stories.md +++ b/docs/_pages/stories.md @@ -109,7 +109,7 @@ sidebar: | [Silver Sparrow](silver_sparrow) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Launch Agent](/tags/#launch-agent), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Data Staged](/tags/#data-staged) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Spearphishing Attachments](spearphishing_attachments) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Spearphishing Link](/tags/#spearphishing-link), [Malicious Link](/tags/#malicious-link), [User Execution](/tags/#user-execution) | [Credential Access](/tags/#credential-access), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access) | | [Spectre And Meltdown Vulnerabilities](spectre_and_meltdown_vulnerabilities) | None | None | -| [Splunk Vulnerabilities](splunk_vulnerabilities) | [File and Directory Discovery](/tags/#file-and-directory-discovery), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Digital Certificates](/tags/#digital-certificates), [Network Denial of Service](/tags/#network-denial-of-service), [Protocol Impersonation](/tags/#protocol-impersonation), [Digital Certificates](/tags/#digital-certificates), [Valid Accounts](/tags/#valid-accounts), [Drive-by Compromise](/tags/#drive-by-compromise), [Network Sniffing](/tags/#network-sniffing) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Resource Development](/tags/#resource-development) | +| [Splunk Vulnerabilities](splunk_vulnerabilities) | [File and Directory Discovery](/tags/#file-and-directory-discovery), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Digital Certificates](/tags/#digital-certificates), [Network Denial of Service](/tags/#network-denial-of-service), [Process Injection](/tags/#process-injection), [Protocol Impersonation](/tags/#protocol-impersonation), [Digital Certificates](/tags/#digital-certificates), [Valid Accounts](/tags/#valid-accounts), [Drive-by Compromise](/tags/#drive-by-compromise), [Network Sniffing](/tags/#network-sniffing) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Resource Development](/tags/#resource-development) | | [Spring4Shell CVE-2022-22965](spring4shell_cve-2022-22965) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Web Shell](/tags/#web-shell), [Server Software Component](/tags/#server-software-component) | [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) | | [Suspicious AWS EC2 Activities](suspicious_aws_ec2_activities) | [Cloud Accounts](/tags/#cloud-accounts), [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Suspicious AWS Login Activities](suspicious_aws_login_activities) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions), [Cloud Accounts](/tags/#cloud-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | diff --git a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md index 051f22e654..4457943a64 100644 --- a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md @@ -101,8 +101,8 @@ This search looks for Web requests to faux domains similar to the one that you w #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml) > :information_source: > **monitor_web_traffic_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md index bbb21c3187..ba87d130b6 100644 --- a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md +++ b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md @@ -124,8 +124,8 @@ This search will detect users creating spikes in API activity related to securit #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_group_api_calls](https://github.com/splunk/security_content/blob/develop/macros/security_group_api_calls.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **detect_spike_in_security_group_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md b/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md index c5f5fd575e..7e2378e968 100644 --- a/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md +++ b/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md @@ -122,8 +122,8 @@ This search will detect users creating spikes in API activity related to network #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [network_acl_events](https://github.com/splunk/security_content/blob/develop/macros/network_acl_events.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) > :information_source: > **detect_spike_in_network_acl_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md index 7f77a75359..cc8964e565 100644 --- a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md +++ b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md @@ -111,8 +111,8 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) > :information_source: > **remote_wmi_command_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-12-06-suspicious_java_classes.md b/docs/_posts/2018-12-06-suspicious_java_classes.md index 3e1d527e90..6fa26f2d66 100644 --- a/docs/_posts/2018-12-06-suspicious_java_classes.md +++ b/docs/_posts/2018-12-06-suspicious_java_classes.md @@ -102,8 +102,8 @@ This search looks for suspicious Java classes that are often used to exploit rem #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_java_classes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md index be75b3546b..875ff5b43e 100644 --- a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md +++ b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md @@ -114,8 +114,8 @@ This search looks for reading lsass memory consistent with credential dumping. #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **detect_credential_dumping_through_lsass_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md index 3de046b373..445b0aa8ec 100644 --- a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md +++ b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md @@ -113,8 +113,8 @@ This search looks for reading loaded Images unique to credential dumping with Mi #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **detect_mimikatz_using_loaded_images_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md index ade57132a5..6228d32f4a 100644 --- a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md +++ b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md @@ -111,8 +111,8 @@ Detect memory dumping of the LSASS process. #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **access_lsass_memory_for_dump_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md index be36a668be..01a8bca88b 100644 --- a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md +++ b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md @@ -111,8 +111,8 @@ Detect remote thread creation into LSASS consistent with credential dumping. #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **create_remote_thread_into_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md index f7818c9cf6..6ce1a2e91d 100644 --- a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md +++ b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md @@ -106,8 +106,8 @@ This search detects loading of unsigned images by LSASS. Deprecated because too #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **unsigned_image_loaded_by_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md index d877cebd94..e89e183dd1 100644 --- a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md +++ b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md @@ -111,8 +111,8 @@ Detect the hands on keyboard behavior of Windows Task Manager creating a process #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **creation_of_lsass_dump_with_taskmgr_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md index 6a0338fdad..9f92f7ce49 100644 --- a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md +++ b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md @@ -113,8 +113,8 @@ Detect the usage of comsvcs.dll for dumping the lsass process. #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md index 1309557b22..f8e8536bb0 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md @@ -103,8 +103,8 @@ This search provides information of unauthenticated requests via user agent, and #### Macros The SPL above uses the following Macros: -* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) > :information_source: > **amazon_eks_kubernetes_cluster_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md index 881939da87..a963f0417f 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md @@ -103,8 +103,8 @@ This search provides detection information on unauthenticated requests against K #### Macros The SPL above uses the following Macros: -* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) > :information_source: > **amazon_eks_kubernetes_pod_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md index 1164dc80d2..ada1ed7f59 100644 --- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md +++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md @@ -113,9 +113,9 @@ This search looks for child processes spawned by zoom.exe or zoom.us that has no #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [previously_seen_zoom_child_processes_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_zoom_child_processes_window.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **first_time_seen_child_process_of_zoom_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md index 45e497632d..58dbbdc38f 100644 --- a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md +++ b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md @@ -119,8 +119,8 @@ This search looks for attempts to stop security-related services on the endpoint #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **attempt_to_stop_security_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md index c51c767f06..46dae84eb1 100644 --- a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md +++ b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md @@ -123,14 +123,14 @@ This search looks for DNS requests for phishing domains that are leveraging Evil #### Macros The SPL above uses the following Macros: -* [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml) -* [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml) * [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml) -* [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml) -* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml) -* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml) * [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml) +* [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml) +* [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml) +* [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml) +* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml) > :information_source: > **detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md index 5f60fe9322..9372642573 100644 --- a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md +++ b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md @@ -116,9 +116,9 @@ This search looks for PowerShell processes started with parameters used to bypas #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **malicious_powershell_process_-_execution_policy_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md index 2ba8eb08fa..9b0f587725 100644 --- a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md +++ b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md @@ -104,8 +104,8 @@ This search detects writes to the 'System Volume Information' folder by somethin #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **suspicious_writes_to_system_volume_information_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md index ed73e8c274..906d51e1ca 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md @@ -117,8 +117,8 @@ This search detects SIGRed via Splunk Stream. #### Macros The SPL above uses the following Macros: -* [stream_dns](https://github.com/splunk/security_content/blob/develop/macros/stream_dns.yml) * [stream_tcp](https://github.com/splunk/security_content/blob/develop/macros/stream_tcp.yml) +* [stream_dns](https://github.com/splunk/security_content/blob/develop/macros/stream_dns.yml) > :information_source: > **detect_windows_dns_sigred_via_splunk_stream_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md index b18c0297cb..16df731e66 100644 --- a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md +++ b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md @@ -114,8 +114,8 @@ This search looks for the creation or deletion of hidden shares using net.exe. #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **create_or_delete_windows_shares_using_net_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md index 5e95657880..40a0588ba7 100644 --- a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md +++ b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md @@ -114,9 +114,9 @@ This search looks for executions of cmd.exe spawned by a process that is often a #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **detect_prohibited_applications_spawning_cmd_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md index 4ae024d1ea..617e428b64 100644 --- a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md +++ b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md @@ -116,8 +116,8 @@ During triage, review the parallel processes - what process moved the native Win #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [is_windows_system_file](https://github.com/splunk/security_content/blob/develop/macros/is_windows_system_file.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [is_windows_system_file](https://github.com/splunk/security_content/blob/develop/macros/is_windows_system_file.yml) > :information_source: > **system_processes_run_from_unexpected_locations_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md index 7e4aa6a628..fd49f87ac7 100644 --- a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md +++ b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md @@ -110,8 +110,8 @@ The malware sunburst will load the malicious dll by SolarWinds.BusinessLayerHost #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **sunburst_correlation_dll_and_network_event_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md index a9eda9f12e..56ad8afeab 100644 --- a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md +++ b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md @@ -108,8 +108,8 @@ The following analytic identifies microsoft.workflow.compiler.exe usage. microso #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml) > :information_source: > **suspicious_microsoft_workflow_compiler_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md index 2981f697b7..3fb78bf21f 100644 --- a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md +++ b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md @@ -113,8 +113,8 @@ The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavi #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) > :information_source: > **suspicious_msbuild_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md index acb9fc9e9c..f3ff99120f 100644 --- a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md +++ b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md @@ -113,8 +113,8 @@ Malicious actors often abuse legitimate Dynamic DNS services to host malicious p #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [dynamic_dns_providers](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_providers.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [dynamic_dns_providers](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_providers.yml) > :information_source: > **detect_hosts_connecting_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md index c82dde054d..d264511cc0 100644 --- a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md +++ b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md @@ -118,9 +118,9 @@ This search looks for PowerShell processes launched with arguments that have cha #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **malicious_powershell_process_with_obfuscation_techniques_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md index 9dd8f0fe7a..76b85517e1 100644 --- a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md +++ b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md @@ -112,8 +112,8 @@ The following analytic identifies "rundll32.exe" execution with inline protocol #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md index 7c5c6ff72c..80f40c2548 100644 --- a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md +++ b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md @@ -113,8 +113,8 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) > :information_source: > **suspicious_mshta_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md index 6c37af2788..bf8e91a006 100644 --- a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md +++ b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md @@ -113,8 +113,8 @@ Upon investigating, look for network connections to remote destinations (interna #### Macros The SPL above uses the following Macros: -* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md index f9cf1a3efd..67902820ae 100644 --- a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md +++ b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md @@ -112,8 +112,8 @@ Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using #### Macros The SPL above uses the following Macros: -* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md index beea6f235b..f790f144d3 100644 --- a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md +++ b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md @@ -108,8 +108,8 @@ During triage, confirm this is procdump.exe executing. If it is the first time a #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **dump_lsass_via_procdump_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md index 5a903ef10e..735dd33b8a 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md @@ -112,8 +112,8 @@ The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md index e305c8b68c..c1f594b00a 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md @@ -112,8 +112,8 @@ The following analytic identifies rundll32.exe loading setupapi.dll and iesetupa #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md index d8c9000127..4f41ad6e86 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md @@ -112,8 +112,8 @@ The following analytic identifies rundll32.exe loading syssetup.dll by calling t #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md index 63ee241b2a..01e838de9a 100644 --- a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md +++ b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md @@ -112,8 +112,8 @@ The following analytic identifies rundll32.exe executing a DLL function name, St #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md index bc208c5e86..be4d30aed2 100644 --- a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md +++ b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md @@ -112,8 +112,8 @@ The following analytic identifies rundll32.exe using dllregisterserver on the co #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md index 130f7c6dcd..082d8597ae 100644 --- a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md +++ b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md @@ -107,9 +107,9 @@ This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **nishang_powershelltcponeline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-03-w3wp_spawning_shell.md b/docs/_posts/2021-03-03-w3wp_spawning_shell.md index 3eca1c53ab..ab18079b5d 100644 --- a/docs/_posts/2021-03-03-w3wp_spawning_shell.md +++ b/docs/_posts/2021-03-03-w3wp_spawning_shell.md @@ -116,10 +116,10 @@ This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **w3wp_spawning_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md index 620ce0a918..18070e75e0 100644 --- a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md +++ b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md @@ -103,8 +103,8 @@ The following analytics identifies a big number of instance of ransomware notes #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **ransomware_notes_bulk_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-16-high_process_termination_frequency.md b/docs/_posts/2021-03-16-high_process_termination_frequency.md index db41bf7dfa..d4cf37746f 100644 --- a/docs/_posts/2021-03-16-high_process_termination_frequency.md +++ b/docs/_posts/2021-03-16-high_process_termination_frequency.md @@ -103,8 +103,8 @@ This analytics are designed to indentify a high frequency of process termination #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **high_process_termination_frequency_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md index 5ac8414b89..b73da35928 100644 --- a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md +++ b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md @@ -102,8 +102,8 @@ This search looks for high frequency of file deletion relative to process name a #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **windows_high_file_deletion_frequency_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md index 69da9eb447..5583fced4f 100644 --- a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md +++ b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md @@ -103,9 +103,9 @@ Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functio #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **powershell_start-bitstransfer_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-12-excel_spawning_powershell.md b/docs/_posts/2021-04-12-excel_spawning_powershell.md index 20d0073cd2..a7a8420e93 100644 --- a/docs/_posts/2021-04-12-excel_spawning_powershell.md +++ b/docs/_posts/2021-04-12-excel_spawning_powershell.md @@ -107,9 +107,9 @@ The following detection identifies Microsoft Excel spawning PowerShell. Typicall #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **excel_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-12-winword_spawning_powershell.md b/docs/_posts/2021-04-12-winword_spawning_powershell.md index 501c9660d5..89a771922f 100644 --- a/docs/_posts/2021-04-12-winword_spawning_powershell.md +++ b/docs/_posts/2021-04-12-winword_spawning_powershell.md @@ -107,9 +107,9 @@ The following detection identifies Microsoft Word spawning PowerShell. Typically #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **winword_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md index 75a6897250..395cc1b89a 100644 --- a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md +++ b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md @@ -107,8 +107,8 @@ this detection was designed to identifies suspicious spawned process of known MS #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md index 56c059af2a..bef8758516 100644 --- a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md +++ b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md @@ -106,8 +106,8 @@ this search detects a potential malicious office document that create schedule t #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **office_document_creating_schedule_task_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-14-office_document_executing_macro_code.md b/docs/_posts/2021-04-14-office_document_executing_macro_code.md index d2d52c4271..eeb3ab4fee 100644 --- a/docs/_posts/2021-04-14-office_document_executing_macro_code.md +++ b/docs/_posts/2021-04-14-office_document_executing_macro_code.md @@ -106,8 +106,8 @@ this detection was designed to identifies suspicious office documents that using #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **office_document_executing_macro_code_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md index 85a2c57319..000c69e486 100644 --- a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md +++ b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md @@ -102,8 +102,8 @@ this search is designed to detect suspicious powershell process that tries to in #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **powershell_remote_thread_to_known_windows_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md index a3a7e05749..caf4fa1b8e 100644 --- a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md +++ b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md @@ -101,8 +101,8 @@ this search is designed to detect potential malicious wermgr.exe process that dr #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **wermgr_process_create_executable_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md index 4cdbd433e0..42583c9bdf 100644 --- a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md +++ b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md @@ -102,10 +102,10 @@ This search is designed to detect suspicious cmd and powershell process spawned #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **wermgr_process_spawned_cmd_or_powershell_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md index f787b8f414..ec93fceb92 100644 --- a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md +++ b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md @@ -109,8 +109,8 @@ This search is designed to detect high frequency of archive files data exfiltrat #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **multiple_archive_files_http_post_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md index e0ae691ef6..c40ab2bb31 100644 --- a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md +++ b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md @@ -107,8 +107,8 @@ The following detection identifies the latest behavior utilized by IcedID malwar #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md index 2f4662d6e8..8b9810d35a 100644 --- a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md +++ b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md @@ -106,8 +106,8 @@ This search is to detect potential plain HTTP POST method data exfiltration. Thi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **plain_http_post_exfiltrated_data_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-22-winword_spawning_cmd.md b/docs/_posts/2021-04-22-winword_spawning_cmd.md index 1d6f90aadf..fb37b43389 100644 --- a/docs/_posts/2021-04-22-winword_spawning_cmd.md +++ b/docs/_posts/2021-04-22-winword_spawning_cmd.md @@ -108,8 +108,8 @@ The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **winword_spawning_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md index 1678be0cca..83ac9784e0 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md +++ b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md @@ -108,8 +108,8 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) > :information_source: > **office_product_spawning_bitsadmin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-26-office_product_spawning_mshta.md b/docs/_posts/2021-04-26-office_product_spawning_mshta.md index 23dc5d2084..e1e4038175 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_mshta.md +++ b/docs/_posts/2021-04-26-office_product_spawning_mshta.md @@ -108,8 +108,8 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) > :information_source: > **office_product_spawning_mshta_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-26-trickbot_named_pipe.md b/docs/_posts/2021-04-26-trickbot_named_pipe.md index 895a6c51d5..cc29fc4eab 100644 --- a/docs/_posts/2021-04-26-trickbot_named_pipe.md +++ b/docs/_posts/2021-04-26-trickbot_named_pipe.md @@ -102,8 +102,8 @@ this search is to detect potential trickbot infection through the create/connect #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **trickbot_named_pipe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md index 43c3a38d63..ff1e142ac3 100644 --- a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md +++ b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md @@ -108,8 +108,8 @@ This analytic will detect suspicious driver loaded paths. This technique is comm #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **suspicious_driver_loaded_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-29-xmrig_driver_loaded.md b/docs/_posts/2021-04-29-xmrig_driver_loaded.md index aea92238c8..7046351428 100644 --- a/docs/_posts/2021-04-29-xmrig_driver_loaded.md +++ b/docs/_posts/2021-04-29-xmrig_driver_loaded.md @@ -108,8 +108,8 @@ This analytic identifies XMRIG coinminer driver installation on the system. The #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **xmrig_driver_loaded_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-deleting_of_net_users.md b/docs/_posts/2021-05-04-deleting_of_net_users.md index cb96058580..bc7dfa7f87 100644 --- a/docs/_posts/2021-05-04-deleting_of_net_users.md +++ b/docs/_posts/2021-05-04-deleting_of_net_users.md @@ -103,8 +103,8 @@ This analytic will detect a suspicious net.exe/net1.exe command-line to delete a #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **deleting_of_net_users_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-disabling_net_user_account.md b/docs/_posts/2021-05-04-disabling_net_user_account.md index e183e6433d..535a631c2c 100644 --- a/docs/_posts/2021-05-04-disabling_net_user_account.md +++ b/docs/_posts/2021-05-04-disabling_net_user_account.md @@ -103,8 +103,8 @@ This analytic will identify a suspicious command-line that disables a user accou #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **disabling_net_user_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md index d04c52af26..7e62bef14e 100644 --- a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md +++ b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md @@ -104,8 +104,8 @@ This analytic identifies suspicious series of attempt to kill multiple services #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **excessive_service_stop_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md index 7832bc24d5..bbecb9975f 100644 --- a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md +++ b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md @@ -108,8 +108,8 @@ The following analytic identifies the use of `wmic.exe` using `delete` to remove #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) > :information_source: > **process_kill_base_on_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-06-download_files_using_telegram.md b/docs/_posts/2021-05-06-download_files_using_telegram.md index e75d99cd23..43eaa37a0b 100644 --- a/docs/_posts/2021-05-06-download_files_using_telegram.md +++ b/docs/_posts/2021-05-06-download_files_using_telegram.md @@ -101,8 +101,8 @@ The following analytic will identify a suspicious download by the Telegram appli #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **download_files_using_telegram_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md index 5024c92f03..9cbb027826 100644 --- a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md +++ b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md @@ -104,8 +104,8 @@ This analytic identifies excessive usage of `net.exe` or `net1.exe` within a buc #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **excessive_usage_of_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md index 869bea7299..64ff8b9995 100644 --- a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md +++ b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md @@ -106,8 +106,8 @@ This analytic detects a potential process using COM Object like CMLUA or CMSTPLU #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **cmlua_or_cmstplua_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md index 09d1324b0b..1ed5f0e08d 100644 --- a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md +++ b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md @@ -120,8 +120,8 @@ This analytic identifies a common behavior by Cobalt Strike and other frameworks #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **cmd_echo_pipe_-_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-02-modification_of_wallpaper.md b/docs/_posts/2021-06-02-modification_of_wallpaper.md index 5286c0105c..bb4baa84c7 100644 --- a/docs/_posts/2021-06-02-modification_of_wallpaper.md +++ b/docs/_posts/2021-06-02-modification_of_wallpaper.md @@ -101,8 +101,8 @@ This analytic identifies suspicious modification of registry to deface or change #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **modification_of_wallpaper_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md index f095875738..aa6d560171 100644 --- a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md +++ b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md @@ -106,8 +106,8 @@ this search is designed to detect potential malicious process loading COM object #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **wbemprox_com_object_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md index d2bde70c61..72713207b3 100644 --- a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md +++ b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md @@ -112,8 +112,8 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **detect_wmi_event_subscription_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md index 18aeadf0f2..a11edd86b5 100644 --- a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md +++ b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md @@ -108,8 +108,8 @@ This search is to detect a suspicious commandline designed to delete files or di #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **recursive_delete_of_directory_in_batch_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md index f3fa23324d..849bccd29b 100644 --- a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md +++ b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md @@ -111,8 +111,8 @@ This search is to detect a suspicious excessive usage of sc.exe in a host machin #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **excessive_usage_of_sc_service_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md index a0f829606a..2ce03df914 100644 --- a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md +++ b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md @@ -117,8 +117,8 @@ During triage, isolate the endpoint and review for source of exploitation. Captu #### Macros The SPL above uses the following Macros: -* [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) > :information_source: > **print_spooler_adding_a_printer_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md index d5094a4a8e..081961e406 100644 --- a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md +++ b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md @@ -118,8 +118,8 @@ During triage, isolate the endpoint and review for source of exploitation. Captu #### Macros The SPL above uses the following Macros: -* [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) > :information_source: > **print_spooler_failed_to_load_a_plug-in_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md index 57fa4e8b70..1972abccfb 100644 --- a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md +++ b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md @@ -114,8 +114,8 @@ The following analytic identifies a suspicious child process, `rundll32.exe`, wi #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md index c3db511f1e..bbc1985d5b 100644 --- a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md +++ b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md @@ -114,8 +114,8 @@ This search is to detect suspicious loading of dll in specific path relative to #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **spoolsv_suspicious_loaded_modules_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md index 406084fcfc..a22067412c 100644 --- a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md +++ b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md @@ -106,8 +106,8 @@ This analytic identifies a suspicious behavior related to PrintNightmare, or CVE #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **spoolsv_suspicious_process_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md index 20678262d5..72cefff943 100644 --- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md +++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md @@ -113,8 +113,8 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **spoolsv_writing_a_dll_-_sysmon_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md index b7f5ee265e..324bc9edb8 100644 --- a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md +++ b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md @@ -107,9 +107,9 @@ This search is to identifies a modification in registry to disable the windows d #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **powershell_disable_security_monitoring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md index 6f9d39c5bf..c9f070f3ec 100644 --- a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md +++ b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md @@ -108,8 +108,8 @@ This search is to detect a suspicious loaded unsigned dll by MMC.exe application #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **uac_bypass_mmc_load_unsigned_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md index 251e2c5e25..18015756a1 100644 --- a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md +++ b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md @@ -107,10 +107,10 @@ This search is to detect a suspicious mshta.exe process that spawn rundll32 or r #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) > :information_source: > **mshta_spawning_rundll32_or_regsvr32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md index 2d76b31dca..1038195192 100644 --- a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md +++ b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md @@ -108,8 +108,8 @@ this search is to detect a suspicious office product process that spawn cmd chil #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **office_product_spawn_cmd_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md index ef3e261bdf..7ee60a9e83 100644 --- a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md +++ b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md @@ -102,8 +102,8 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **rundll32_createremotethread_in_browser_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md index 2612bc03e8..2fee621286 100644 --- a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md +++ b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md @@ -106,8 +106,8 @@ This search is to detect a suspicious rundll32 process that drops executable (.e #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **rundll32_process_creating_exe_dll_files_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md index fa9fa4b335..e574e6f691 100644 --- a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md +++ b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md @@ -107,8 +107,8 @@ This search is to detect a suspicious rundll32.exe commandline to execute dll fi #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md index 14846a2e0e..2c4448604c 100644 --- a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md +++ b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md @@ -107,8 +107,8 @@ This search is to detect a suspicious rundll32.exe process with plugininit param #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md index a70a85e8c3..27cbb5c585 100644 --- a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md +++ b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md @@ -109,8 +109,8 @@ The following analytic identifies Regsvr32.exe utilizing the silent switch to lo #### Macros The SPL above uses the following Macros: -* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md index 57dd88fc58..fdf4ec8c06 100644 --- a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md +++ b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md @@ -102,8 +102,8 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **rundll32_create_remote_thread_to_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-30-drop_icedid_license_dat.md b/docs/_posts/2021-07-30-drop_icedid_license_dat.md index 229fecc735..35acb6bef9 100644 --- a/docs/_posts/2021-07-30-drop_icedid_license_dat.md +++ b/docs/_posts/2021-07-30-drop_icedid_license_dat.md @@ -106,8 +106,8 @@ This search is to detect dropping a suspicious file named as "license.dat" in %a #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **drop_icedid_license_dat_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md index 1f2de9c0c4..7ee2b55ee4 100644 --- a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md +++ b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md @@ -106,8 +106,8 @@ This search is to detect a suspicious file creation namely passff.tar and cookie #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **icedid_exfiltrated_archived_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md index d478b8a1dc..ae7b48391d 100644 --- a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md +++ b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md @@ -107,8 +107,8 @@ this detection was designed to identifies suspicious spawned process of known MS #### Macros The SPL above uses the following Macros: -* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md index 24da952f26..e3ec1efb85 100644 --- a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md +++ b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md @@ -101,8 +101,8 @@ This search is to detect a suspicious file creation of sqlite3.dll in %temp% fol #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **sqlite_module_in_temp_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md index 2d8501f31d..bf0db94672 100644 --- a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md +++ b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md @@ -102,8 +102,8 @@ This search is to detect suspicious process injection in command shell. This tec #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **create_remote_thread_in_shell_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md index 3fb4417f2a..65a9387f53 100644 --- a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md +++ b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md @@ -106,8 +106,8 @@ This search is to detect a possible uac bypass using the colorui.dll COM Object. #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **uac_bypass_with_colorui_com_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md index b006f6f12e..ed38bcefb7 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md @@ -108,8 +108,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **domain_account_discovery_with_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md index d63185fdba..db880108c1 100644 --- a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md +++ b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md @@ -111,8 +111,8 @@ This search uses the Kubernetes logs from Splunk Connect from Kubernetes to dete #### Macros The SPL above uses the following Macros: -* [kube_objects_events](https://github.com/splunk/security_content/blob/develop/macros/kube_objects_events.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [kube_objects_events](https://github.com/splunk/security_content/blob/develop/macros/kube_objects_events.yml) > :information_source: > **kubernetes_scanner_image_pulling_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md index 27495bc909..a4109f88e7 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md +++ b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md @@ -107,8 +107,8 @@ Review the source attempting to perform this activity against your environment. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [exchange](https://github.com/splunk/security_content/blob/develop/macros/exchange.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **exchange_powershell_abuse_via_ssrf_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-circle_ci_disable_security_step.md b/docs/_posts/2021-09-01-circle_ci_disable_security_step.md index 71a252f6f8..9e27a6d39f 100644 --- a/docs/_posts/2021-09-01-circle_ci_disable_security_step.md +++ b/docs/_posts/2021-09-01-circle_ci_disable_security_step.md @@ -117,8 +117,8 @@ This search looks for disable security step in CircleCI pipeline. #### Macros The SPL above uses the following Macros: -* [circleci](https://github.com/splunk/security_content/blob/develop/macros/circleci.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [circleci](https://github.com/splunk/security_content/blob/develop/macros/circleci.yml) > :information_source: > **circle_ci_disable_security_step_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md index 2d64e0e59c..5472ee8db6 100644 --- a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md +++ b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md @@ -114,9 +114,9 @@ This search looks for Pull Request from unknown user. #### Macros The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [github_known_users](https://github.com/splunk/security_content/blob/develop/macros/github_known_users.yml) * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **github_pull_request_from_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-02-circle_ci_disable_security_job.md b/docs/_posts/2021-09-02-circle_ci_disable_security_job.md index 136c9bacd3..735373a9e4 100644 --- a/docs/_posts/2021-09-02-circle_ci_disable_security_job.md +++ b/docs/_posts/2021-09-02-circle_ci_disable_security_job.md @@ -113,8 +113,8 @@ This search looks for disable security job in CircleCI pipeline. #### Macros The SPL above uses the following Macros: -* [circleci](https://github.com/splunk/security_content/blob/develop/macros/circleci.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [circleci](https://github.com/splunk/security_content/blob/develop/macros/circleci.yml) > :information_source: > **circle_ci_disable_security_job_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md index 64cb7c7e3c..5f1e7fe3f7 100644 --- a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md +++ b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md @@ -106,8 +106,8 @@ This analytic is to detect an application try to connect and create ADSI Object #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **schcache_change_by_app_connect_and_create_adsi_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md index a6cbdb54f1..134b9a1a46 100644 --- a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md +++ b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md @@ -112,8 +112,8 @@ The following hunting detection identifies rundll32.exe with `control_rundll` wi #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md index d74d500fcd..9e7b8b4572 100644 --- a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md +++ b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md @@ -112,8 +112,8 @@ The following detection identifies rundll32.exe with `control_rundll` within the #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-09-09-extraction_of_registry_hives.md b/docs/_posts/2021-09-09-extraction_of_registry_hives.md index 906af392f7..a39d5f8422 100644 --- a/docs/_posts/2021-09-09-extraction_of_registry_hives.md +++ b/docs/_posts/2021-09-09-extraction_of_registry_hives.md @@ -108,8 +108,8 @@ The following analytic identifies the use of `reg.exe` exporting Windows Registr #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) > :information_source: > **extraction_of_registry_hives_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md index 397b2fde50..3b0d396361 100644 --- a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md +++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md @@ -106,8 +106,8 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **ms_scripting_process_loading_ldap_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md index 9b34319ea7..d0dc7976de 100644 --- a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md +++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md @@ -106,8 +106,8 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **ms_scripting_process_loading_wmi_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md index 34a46ae1ab..7799ae5de6 100644 --- a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md +++ b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md @@ -103,8 +103,8 @@ This search is to detect a suspicious wmic.exe process or renamed wmic process t #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) > :information_source: > **xsl_script_execution_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-account_discovery_with_net_app.md b/docs/_posts/2021-09-16-account_discovery_with_net_app.md index ef8f22531b..7eede94a27 100644 --- a/docs/_posts/2021-09-16-account_discovery_with_net_app.md +++ b/docs/_posts/2021-09-16-account_discovery_with_net_app.md @@ -109,8 +109,8 @@ this search is to detect a potential account discovery series of command used by #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **account_discovery_with_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md index 9aa29771a0..03592ce7d2 100644 --- a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md +++ b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md @@ -114,9 +114,9 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: > **attempted_credential_dump_from_registry_via_reg_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-bits_job_persistence.md b/docs/_posts/2021-09-16-bits_job_persistence.md index 65b5026013..1de2af652c 100644 --- a/docs/_posts/2021-09-16-bits_job_persistence.md +++ b/docs/_posts/2021-09-16-bits_job_persistence.md @@ -104,8 +104,8 @@ The following query identifies Microsoft Background Intelligent Transfer Service #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) > :information_source: > **bits_job_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-bitsadmin_download_file.md b/docs/_posts/2021-09-16-bitsadmin_download_file.md index e430f829c2..d2c8c7bf2d 100644 --- a/docs/_posts/2021-09-16-bitsadmin_download_file.md +++ b/docs/_posts/2021-09-16-bitsadmin_download_file.md @@ -109,8 +109,8 @@ The following query identifies Microsoft Background Intelligent Transfer Service #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) > :information_source: > **bitsadmin_download_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md index d5760a955e..7b9f556da7 100644 --- a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md +++ b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md @@ -112,10 +112,10 @@ This search detects the use of wmic and Powershell to create a shadow copy. #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **creation_of_shadow_copy_with_wmic_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md index 6b569688ce..f6f060195b 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md @@ -113,8 +113,8 @@ This search detects credential dumping using copy command from a shadow copy. #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **credential_dumping_via_copy_command_from_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md index 21b44df3dd..d6a564ecf3 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md @@ -113,8 +113,8 @@ This search detects the creation of a symlink to a shadow copy. #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **credential_dumping_via_symlink_to_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md index 2301b8a300..a314652ee7 100644 --- a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md @@ -113,8 +113,8 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) > :information_source: > **detect_html_help_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md index 879ffee11e..f7fe599fd1 100644 --- a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md +++ b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md @@ -113,8 +113,8 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) > :information_source: > **detect_html_help_using_infotech_storage_handlers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md index 917308ab5f..778d8b6ff4 100644 --- a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md +++ b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md @@ -113,8 +113,8 @@ The following analytic identifies "mshta.exe" execution with inline protocol han #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) > :information_source: > **detect_mshta_inline_hta_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md index 6d3b9fd3f3..7ec5743895 100644 --- a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md @@ -113,8 +113,8 @@ This analytic identifies when Microsoft HTML Application Host (mshta.exe) utilit #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) > :information_source: > **detect_mshta_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md index 1a41c5629e..71034b077f 100644 --- a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md +++ b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md @@ -114,9 +114,9 @@ During triage, confirm this is procdump.exe executing. If it is the first time a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_procdump](https://github.com/splunk/security_content/blob/develop/macros/process_procdump.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **dump_lsass_via_procdump_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_net.md b/docs/_posts/2021-09-16-local_account_discovery_with_net.md index f8eb2e3127..b1aa6cdf31 100644 --- a/docs/_posts/2021-09-16-local_account_discovery_with_net.md +++ b/docs/_posts/2021-09-16-local_account_discovery_with_net.md @@ -108,8 +108,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **local_account_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md index df514a0d38..34a3d5138b 100644 --- a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md +++ b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md @@ -108,8 +108,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) > :information_source: > **local_account_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-office_product_spawning_wmic.md b/docs/_posts/2021-09-16-office_product_spawning_wmic.md index 82fd721322..eed2b96620 100644 --- a/docs/_posts/2021-09-16-office_product_spawning_wmic.md +++ b/docs/_posts/2021-09-16-office_product_spawning_wmic.md @@ -108,8 +108,8 @@ The following detection identifies the latest behavior utilized by Ursnif malwar #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) > :information_source: > **office_product_spawning_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-29-verclsid_clsid_execution.md b/docs/_posts/2021-09-29-verclsid_clsid_execution.md index 81c53e695d..be4fd3f7ba 100644 --- a/docs/_posts/2021-09-29-verclsid_clsid_execution.md +++ b/docs/_posts/2021-09-29-verclsid_clsid_execution.md @@ -107,9 +107,9 @@ This analytic is to detect a possible abuse of verclsid to execute malicious fil #### Macros The SPL above uses the following Macros: -* [process_verclsid](https://github.com/splunk/security_content/blob/develop/macros/process_verclsid.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_verclsid](https://github.com/splunk/security_content/blob/develop/macros/process_verclsid.yml) > :information_source: > **verclsid_clsid_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md index 18327b1dbb..26d9c2b9b0 100644 --- a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md +++ b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md @@ -108,8 +108,8 @@ This analytic is to detect a suspicious child process of MSBuild spawned by Wind #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) > :information_source: > **msbuild_suspicious_spawned_by_script_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md index 9a0aea5cea..9014907709 100644 --- a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md +++ b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md @@ -109,8 +109,8 @@ This analytic is to detect a loading of dll using regsvr32 application with sile #### Macros The SPL above uses the following Macros: -* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md index f51ec23ad7..a3863a8678 100644 --- a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md +++ b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md @@ -102,8 +102,8 @@ This analytic is to detect a suspicious rundll32 commandline to clear shim cache #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2021-10-06-sdelete_application_execution.md b/docs/_posts/2021-10-06-sdelete_application_execution.md index 435972ee36..d81e1b179e 100644 --- a/docs/_posts/2021-10-06-sdelete_application_execution.md +++ b/docs/_posts/2021-10-06-sdelete_application_execution.md @@ -112,9 +112,9 @@ This analytic is to detect the execution of sdelete.exe application sysinternal #### Macros The SPL above uses the following Macros: -* [process_sdelete](https://github.com/splunk/security_content/blob/develop/macros/process_sdelete.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_sdelete](https://github.com/splunk/security_content/blob/develop/macros/process_sdelete.yml) > :information_source: > **sdelete_application_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md index 7a1f5eedc5..28feffa6ea 100644 --- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md +++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md @@ -110,8 +110,8 @@ During triage, review parallel processes for further suspicious activity. #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_setspn](https://github.com/splunk/security_content/blob/develop/macros/process_setspn.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_setspn](https://github.com/splunk/security_content/blob/develop/macros/process_setspn.yml) > :information_source: > **serviceprincipalnames_discovery_with_setspn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md index 22720e91d1..4320088985 100644 --- a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md +++ b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md @@ -105,8 +105,8 @@ During triage, review parallel processes for further behavior. In addition, iden #### Macros The SPL above uses the following Macros: * [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_curl_download_to_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md index fe5471fb42..1aa535fe1c 100644 --- a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md +++ b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md @@ -107,8 +107,8 @@ Adversaries may use one of the three methods based on the remote destination and #### Macros The SPL above uses the following Macros: * [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_curl_upload_to_remote_destination_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md index 83bfac410c..3e2d9784e0 100644 --- a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md +++ b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md @@ -103,8 +103,8 @@ The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible St #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) > :information_source: > **wmic_xsl_execution_via_url_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md index 52abb47d1e..3a1c7dbb39 100644 --- a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md +++ b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md @@ -108,8 +108,8 @@ this analytic is to detect a suspicious compile before delivery approach of .net #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml) > :information_source: > **csc_net_on_the_fly_compilation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md index 1f87ace6f7..971dd3bbde 100644 --- a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md +++ b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md @@ -108,8 +108,8 @@ This analytic look for a spawned process of route.exe windows application. Adver #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_route](https://github.com/splunk/security_content/blob/develop/macros/process_route.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_route](https://github.com/splunk/security_content/blob/develop/macros/process_route.yml) > :information_source: > **network_discovery_using_route_windows_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md index 41a3561c9d..59357aa8f6 100644 --- a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md +++ b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md @@ -111,8 +111,8 @@ This analytic identifies wmic.exe being launched with parameters to spawn a proc #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) > :information_source: > **remote_process_instantiation_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md index 215c786252..1eb00cabc5 100644 --- a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md +++ b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md @@ -111,9 +111,9 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_installutil_uninstall_option_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md index dfc676e66c..528f6b0294 100644 --- a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md +++ b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md @@ -110,9 +110,9 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_installutil_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md index 73a0c311f5..37b92ca050 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md @@ -107,9 +107,9 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **remote_process_instantiation_via_dcom_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md index f50a85740c..133e5e5ae1 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md @@ -102,9 +102,9 @@ This analytic looks for the execution of `powershell.exe` leveraging the `Invoke #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **remote_process_instantiation_via_wmi_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md index 458e515aef..d611b7f432 100644 --- a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md +++ b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md @@ -107,9 +107,9 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **remote_process_instantiation_via_winrm_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md index 1c834b88c8..ab844da06b 100644 --- a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md +++ b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md @@ -108,8 +108,8 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **loading_of_dynwrapx_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md index 180db1a279..d94c2cff62 100644 --- a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md +++ b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md @@ -119,8 +119,8 @@ In addition, `msi.dll` has been abused in DLL side-loading attacks by being load #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **msi_module_loaded_by_non-system_binary_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-13-windows_java_spawning_shells.md b/docs/_posts/2021-12-13-windows_java_spawning_shells.md index e831d6cb09..4a076c35c3 100644 --- a/docs/_posts/2021-12-13-windows_java_spawning_shells.md +++ b/docs/_posts/2021-12-13-windows_java_spawning_shells.md @@ -110,8 +110,8 @@ The following analytic identifies the process name of java.exe and w3wp.exe spaw #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) > :information_source: > **windows_java_spawning_shells_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md index 5b55936c2f..a7e3a6be4d 100644 --- a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md +++ b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md @@ -126,9 +126,9 @@ The following hunting analytic identifies PowerShell commands utilizing the Wind #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **powershell_-_connect_to_internet_with_hidden_window_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md index ee9b513261..58ff38a98a 100644 --- a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md +++ b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md @@ -109,8 +109,8 @@ The following hunting analytic identifies all processes requesting access into L #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **windows_hunting_system_account_targeting_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md index cc2eb7766c..c48ad067c4 100644 --- a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md +++ b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md @@ -109,8 +109,8 @@ The following analytic identifies non SYSTEM accounts requesting access to lsass #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **windows_non-system_account_targeting_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md index b0cb5436ae..70436ece37 100644 --- a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md +++ b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md @@ -113,8 +113,8 @@ The following analytic identifies command-line arguments where `cmd.exe /c` is u #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) > :information_source: > **cmd_carry_out_string_command_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md index 383cc57008..f58ff3f639 100644 --- a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md +++ b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md @@ -119,9 +119,9 @@ Alternatively, may use regex per matching here https://regexr.com/662ov. #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **malicious_powershell_process_-_encoded_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md index 02fb93e350..b4a40a14d5 100644 --- a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md +++ b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md @@ -106,8 +106,8 @@ This analytic detects a suspicious process making a DNS query via known, abused #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **suspicious_process_dns_query_known_abuse_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md index d77807e154..12c713a123 100644 --- a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md +++ b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md @@ -119,8 +119,8 @@ The following analytic identifies native .net binaries within the Windows operat #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [is_net_windows_file](https://github.com/splunk/security_content/blob/develop/macros/is_net_windows_file.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [is_net_windows_file](https://github.com/splunk/security_content/blob/develop/macros/is_net_windows_file.yml) > :information_source: > **windows_dotnet_binary_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md index 58e4d0e11d..921bf0c555 100644 --- a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md +++ b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md @@ -117,9 +117,9 @@ The following analytic identifies the Windows binary InstallUtil.exe running fro #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_installutil_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md index 837ffae589..f0282edf5f 100644 --- a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md +++ b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md @@ -108,8 +108,8 @@ This analytic will identify excessive file deletion events in the Windows Defend #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **excessive_file_deletion_in_windefender_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-20-ping_sleep_batch_command.md b/docs/_posts/2022-01-20-ping_sleep_batch_command.md index cc3548f17a..548baa0f37 100644 --- a/docs/_posts/2022-01-20-ping_sleep_batch_command.md +++ b/docs/_posts/2022-01-20-ping_sleep_batch_command.md @@ -116,8 +116,8 @@ This analytic will identify the possible execution of ping sleep batch commands. #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_ping](https://github.com/splunk/security_content/blob/develop/macros/process_ping.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_ping](https://github.com/splunk/security_content/blob/develop/macros/process_ping.yml) > :information_source: > **ping_sleep_batch_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md index 7799ba7e41..e89c702ca3 100644 --- a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md +++ b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md @@ -113,8 +113,8 @@ The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll. #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **windows_possible_credential_dumping_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md index 7e85cb86f9..df18dc6ceb 100644 --- a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md +++ b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md @@ -108,8 +108,8 @@ The following analytic looks for a process accessing the winlogon.exe system pro #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **rubeus_kerberos_ticket_exports_through_winlogon_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md index 750df54c18..e5645065c1 100644 --- a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md +++ b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md @@ -104,8 +104,8 @@ The following analytic identifies the use of Microsoft Remote Assistance, msra.e #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) > :information_source: > **windows_remote_assistance_spawning_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md index 1ca1e1d4f7..64239bc1a7 100644 --- a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md +++ b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md @@ -113,8 +113,8 @@ The following analytic identifies rundll32.exe loading an export function by ord #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md index 12bd46fc7a..39f2b80d72 100644 --- a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md +++ b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md @@ -112,8 +112,8 @@ This analytic is to look for suspicious raw access read to drive where the maste #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **windows_raw_access_to_master_boot_record_drive_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md index b8e76acd2d..51d1e73d56 100644 --- a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md +++ b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md @@ -111,8 +111,8 @@ The following analytic identifies regasm.exe with a network connection to a publ #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **detect_regasm_with_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md index 6c6367c37c..663285a202 100644 --- a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md +++ b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md @@ -111,8 +111,8 @@ The following analytic identifies Regsvcs.exe with a network connection to a pub #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **detect_regsvcs_with_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md index d2e44a1965..fe11db54f8 100644 --- a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md +++ b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md @@ -103,8 +103,8 @@ This detection is to identify a suspicious process that tries to delete the proc #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **process_deleting_its_process_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-rundll32_dnsquery.md b/docs/_posts/2022-02-18-rundll32_dnsquery.md index d2f3c5bda6..75b9319c65 100644 --- a/docs/_posts/2022-02-18-rundll32_dnsquery.md +++ b/docs/_posts/2022-02-18-rundll32_dnsquery.md @@ -106,8 +106,8 @@ This search is to detect a suspicious rundll32.exe process having a http connect #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **rundll32_dnsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md index 65ca269f9e..354377901f 100644 --- a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md +++ b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md @@ -109,8 +109,8 @@ This analytic is to look for wmi commandlines to execute or create process. This #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) > :information_source: > **windows_wmi_process_call_create_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md index 539abbfa7f..8585a4f9e0 100644 --- a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md +++ b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md @@ -112,8 +112,8 @@ This analytic is to look for suspicious raw access read to device disk partition #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **windows_raw_access_to_disk_volume_partition_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-08-suspicious_msbuild_path.md b/docs/_posts/2022-03-08-suspicious_msbuild_path.md index f3a0b01783..cdc1d04670 100644 --- a/docs/_posts/2022-03-08-suspicious_msbuild_path.md +++ b/docs/_posts/2022-03-08-suspicious_msbuild_path.md @@ -123,8 +123,8 @@ The following analytic identifies msbuild.exe executing from a non-standard path #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) > :information_source: > **suspicious_msbuild_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md index 2a33a397b7..a4972826ff 100644 --- a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md @@ -113,8 +113,8 @@ The following analytic identifies regsvcs.exe with no command line arguments. Th #### Macros The SPL above uses the following Macros: -* [process_regsvcs](https://github.com/splunk/security_content/blob/develop/macros/process_regsvcs.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_regsvcs](https://github.com/splunk/security_content/blob/develop/macros/process_regsvcs.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md index 4c780c3d97..61890d3fea 100644 --- a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md +++ b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md @@ -118,8 +118,8 @@ The following analytic identifies rundll32.exe with no command line arguments an #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md index f1df36b2c2..8b4e61d37a 100644 --- a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md @@ -104,9 +104,9 @@ The following analytic identifies gpupdate.exe with no command line arguments. I #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_gpupdate](https://github.com/splunk/security_content/blob/develop/macros/process_gpupdate.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **suspicious_gpupdate_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md index 3805e9254b..1124eaa96f 100644 --- a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md @@ -118,8 +118,8 @@ The following analytic identifies rundll32.exe with no command line arguments. I #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) > :information_source: diff --git a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md index a695f6e7b7..02546a0eed 100644 --- a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md +++ b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md @@ -115,9 +115,9 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_installutil_remote_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md index e7ffbdeb55..4eba7529a2 100644 --- a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md +++ b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md @@ -116,9 +116,9 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **windows_installutil_uninstall_option_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-28-windows_terminating_lsass_process.md b/docs/_posts/2022-03-28-windows_terminating_lsass_process.md index 42ee8d7ce7..424eff1d3a 100644 --- a/docs/_posts/2022-03-28-windows_terminating_lsass_process.md +++ b/docs/_posts/2022-03-28-windows_terminating_lsass_process.md @@ -111,8 +111,8 @@ This analytic is to detect a suspicious process terminating Lsass process. Lsass #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **windows_terminating_lsass_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md b/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md index c503983391..f5be1cf051 100644 --- a/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md +++ b/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md @@ -112,8 +112,8 @@ The following analytic assists with viewing all drivers being loaded by using Sy #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **windows_drivers_loaded_by_signature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md b/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md index d73eeffe74..aa65234c4a 100644 --- a/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md +++ b/docs/_posts/2022-04-06-web_spring4shell_http_request_class_module.md @@ -113,8 +113,8 @@ The following analytic identifies the payload related to Spring4Shell, CVE-2022- #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) > :information_source: > **web_spring4shell_http_request_class_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-any_powershell_downloadfile.md b/docs/_posts/2022-04-07-any_powershell_downloadfile.md index 65e39d055c..329d185ff5 100644 --- a/docs/_posts/2022-04-07-any_powershell_downloadfile.md +++ b/docs/_posts/2022-04-07-any_powershell_downloadfile.md @@ -117,9 +117,9 @@ The following analytic identifies the use of PowerShell downloading a file using #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **any_powershell_downloadfile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-07-any_powershell_downloadstring.md b/docs/_posts/2022-04-07-any_powershell_downloadstring.md index d7ba5d5cc3..4ed02b76f5 100644 --- a/docs/_posts/2022-04-07-any_powershell_downloadstring.md +++ b/docs/_posts/2022-04-07-any_powershell_downloadstring.md @@ -112,9 +112,9 @@ The following analytic identifies the use of PowerShell downloading a file using #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) > :information_source: > **any_powershell_downloadstring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md b/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md index 7192ee4b40..4502ff62f6 100644 --- a/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md +++ b/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md @@ -108,8 +108,8 @@ This search looks for the execution of `nltest.exe` with command-line arguments #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_nltest](https://github.com/splunk/security_content/blob/develop/macros/process_nltest.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_nltest](https://github.com/splunk/security_content/blob/develop/macros/process_nltest.yml) > :information_source: > **nltest_domain_trust_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md b/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md index 7249744d4d..b10e220124 100644 --- a/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md +++ b/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md @@ -107,8 +107,8 @@ The following analytic is to look for known processes killed by industroyer2 mal #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **windows_processes_killed_by_industroyer2_malware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md b/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md index 562a6beea7..484b31b7fd 100644 --- a/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md +++ b/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md @@ -108,8 +108,8 @@ Upon triage, review the process performing the named pipe. If it is explorer.exe #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **cobalt_strike_named_pipes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-05-26-splunk_process_injection_forwarder_bundle_downloads.md b/docs/_posts/2022-05-26-splunk_process_injection_forwarder_bundle_downloads.md index cfb560b194..7476b0ef44 100644 --- a/docs/_posts/2022-05-26-splunk_process_injection_forwarder_bundle_downloads.md +++ b/docs/_posts/2022-05-26-splunk_process_injection_forwarder_bundle_downloads.md @@ -132,7 +132,7 @@ This hunting search uses native logs produced when a deployment server is within None at this time. #### Associated Analytic story -* [Splunk Vulnerabilites](/stories/splunk_vulnerabilites) +* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities) diff --git a/docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md b/docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md index 174eac3cf3..b18ce4fe3e 100644 --- a/docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md +++ b/docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md @@ -112,8 +112,8 @@ The following detection identifies the module load of mshtml.dll into an Office #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **mshtml_module_load_in_office_product_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md b/docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md index a841bd35e8..d62428fbc2 100644 --- a/docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md +++ b/docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md @@ -112,8 +112,8 @@ This analytic identifies a process making a DNS query to Discord, a well known i #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **suspicious_process_with_discord_dns_query_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md b/docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md index 8cc453ba00..cdc455112a 100644 --- a/docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md +++ b/docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md @@ -106,8 +106,8 @@ this search is designed to detect suspicious wermgr.exe process that tries to co #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **wermgr_process_connecting_to_ip_check_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-06-01-windows_installutil_credential_theft.md b/docs/_posts/2022-06-01-windows_installutil_credential_theft.md index 08612d4668..41f5193809 100644 --- a/docs/_posts/2022-06-01-windows_installutil_credential_theft.md +++ b/docs/_posts/2022-06-01-windows_installutil_credential_theft.md @@ -110,8 +110,8 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **windows_installutil_credential_theft_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md b/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md index 0acdbed77f..93e889596e 100644 --- a/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md +++ b/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md @@ -106,8 +106,8 @@ This search is to detect potential DNS exfiltration using nslookup application. #### Macros The SPL above uses the following Macros: -* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) > :information_source: > **excessive_usage_of_nslookup_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_stories/splunk_vulnerabilities.md b/docs/_stories/splunk_vulnerabilities.md index a6397c199f..112db56d1a 100644 --- a/docs/_stories/splunk_vulnerabilities.md +++ b/docs/_stories/splunk_vulnerabilities.md @@ -41,6 +41,7 @@ This analytic story includes detections that focus on attacker behavior targeted | [Splunk Digital Certificates Infrastructure Version](/application/splunk_digital_certificates_infrastructure_version/) | [Digital Certificates](/tags/#digital-certificates)| Hunting | | [Splunk Digital Certificates Lack of Encryption](/application/splunk_digital_certificates_lack_of_encryption/) | [Digital Certificates](/tags/#digital-certificates)| Anomaly | | [Splunk DoS via Malformed S2S Request](/application/splunk_dos_via_malformed_s2s_request/) | [Network Denial of Service](/tags/#network-denial-of-service)| TTP | +| [Splunk Process Injection Forwarder Bundle Downloads](/application/splunk_process_injection_forwarder_bundle_downloads/) | [Process Injection](/tags/#process-injection)| Hunting | | [Splunk Protocol Impersonation Weak Encryption Configuration](/application/splunk_protocol_impersonation_weak_encryption_configuration/) | [Protocol Impersonation](/tags/#protocol-impersonation)| Hunting | | [Splunk protocol impersonation weak encryption selfsigned](/application/splunk_protocol_impersonation_weak_encryption_selfsigned/) | [Digital Certificates](/tags/#digital-certificates)| Hunting | | [Splunk protocol impersonation weak encryption simplerequest](/application/splunk_protocol_impersonation_weak_encryption_simplerequest/) | [Digital Certificates](/tags/#digital-certificates)| Hunting | From 0cf536acd5cf4f399ad3e0d8320d542c2a50c621 Mon Sep 17 00:00:00 2001 From: Xiao Lin Date: Tue, 14 Jun 2022 20:13:42 -0700 Subject: [PATCH 146/148] fix path error --- ...nk_command_and_scripting_interpreter_risky_spl_mltk.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.test.yml b/tests/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.test.yml index 00c80c42b7..94b5ff8a0f 100644 --- a/tests/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.test.yml +++ b/tests/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.test.yml @@ -1,7 +1,7 @@ name: Splunk Command and Scripting Interpreter Risky SPL MLTK Unit Test tests: - name: Splunk Command and Scripting Interpreter Risky SPL MLTK - file: splunk_command_and_scripting_interpreter_risky_spl_mltk.yml + file: application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml pass_condition: '| stats count | where count > 0' earliest_time: -1h latest_time: now From 863259df93a12b4a1bdf8c5fa9447172afffe3e0 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 15 Jun 2022 13:49:56 -0500 Subject: [PATCH 147/148] Updated per #2235 --- .../network/detect_unauthorized_assets_by_mac_address.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/experimental/network/detect_unauthorized_assets_by_mac_address.yml b/detections/experimental/network/detect_unauthorized_assets_by_mac_address.yml index 949fe28962..ec528dbb12 100644 --- a/detections/experimental/network/detect_unauthorized_assets_by_mac_address.yml +++ b/detections/experimental/network/detect_unauthorized_assets_by_mac_address.yml @@ -1,6 +1,6 @@ name: Detect Unauthorized Assets by MAC address id: dcfd6b40-42f9-469d-a433-2e53f7489ff4 -version: 1 +version: 2 date: '2017-09-13' author: Bhavin Patel, Splunk type: TTP @@ -13,7 +13,7 @@ description: By populating the organization's assets within the assets_by_str.cs associated with the source of the DHCP request is checked against the list of known devices, and reports on those that are not found. search: '| tstats `security_content_summariesonly` count from datamodel=Network_Sessions - where nodename=All_Sessions.DHCP All_Sessions.signature=DHCPREQUEST by All_Sessions.src_ip + where nodename=All_Sessions.DHCP All_Sessions.tag=dhcp by All_Sessions.dest_ip All_Sessions.dest_mac | dedup All_Sessions.dest_mac| `drop_dm_object_name("Network_Sessions")`|`drop_dm_object_name("All_Sessions")` | search NOT [| inputlookup asset_lookup_by_str |rename mac as dest_mac | fields + dest_mac] | `detect_unauthorized_assets_by_mac_address_filter`' From dbf1c528649f7592edd8449a0669704d12068d75 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 16 Jun 2022 13:08:02 -0500 Subject: [PATCH 148/148] Update splunk_process_injection_forwarder_bundle_downloads.yml --- .../splunk_process_injection_forwarder_bundle_downloads.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml index cf8263c8a8..1e0ca4536d 100644 --- a/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml +++ b/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml @@ -22,7 +22,6 @@ tags: - CIS 16 cve: - CVE-2022-32157 - - CVE-2022-32158 confidence: 70 context: - Source:Endpoint